Release 4.214.0

A train of four pull requests: the Arrange editor (#481), one inline comment thread for every site (#479), the bar's first paint following the sign-in hint (#482) and four redrawn glyphs (#484).

• The Arrange editor: a person's own controls, on the real parts. ov-arrange.js is loaded only when someone presses Arrange, and loads ov-arrange-core.js (openvibe-sdk/ui-layout for the browser, generated by scripts/build-arrange-core.js) from beside itself by content hash. A surface's [data-ov-part] elements are placed from a ui.layout@1: drag to move on the grid, the corner to resize, arrows to move and Shift with the arrows to resize (a docked overlay chooses an edge the same way). The part's sheet has visible, size, tint, shape, opacity, label and bindings; long press opens it on a phone. The SDK rules refuse a bad move with the reason in plain words (Stop has to stay visible; it is too small), every move and resize is announced, and Undo, Reset to default, Save and Share are in the bar. Ask OpenVibe's ui.layout.suggestion is previewed on the real parts and applied only with Keep; Motion Off shows no animation and Calm plays the short one. (#481)

• One inline comment thread for every site: thread.renderThread and thread-inline.css (new), beside the composer. MediaHub's Video and Pics item pages and Community's paste and /c pages rendered two copies of the same thread; the renderer now lives in openvibe-shared/thread, with both sites' options: attachmentsAllowed (Pics and a paste page offer files; elsewhere the composer does not) and draft (the message kept after a failed post). It draws the quiet head, Top and Newest only when there is something to order, the composer or one sign-in line (the whole empty state when nobody has commented), the comments with their replies, targets, deletions and attachments, More, and the discussion link. The markup is byte-for-byte what the two sites render; each keeps its own post, delete and sign-in routes. The stylesheet is served like the package's other CSS (/shared/thread-inline.css?v=<content hash>, files.js STYLES), so a site pins one look. Both sites' renderer tests are here; MediaHub and Community delete their copies and pin this release. (#479)

• The bar's first paint follows the sign-in hint (asks 327, 345). When ov_sso_hint says account, navbar.js draws the signed-in shape at once: a neutral placeholder avatar, and the account's own name/initial only when the hint carries it (account:<username>); the session check then replaces it or corrects the bar to guest. A failed check no longer leaves the optimistic bar behind, and an explicit guest hint keeps the guest bar and starts no silent round trip. The hint is never authorization: it holds no token and is not remembered as an account. sso-client.js stores the name after a FedCM sign-in when the response has one. (#482)

• Glyphs: care, fish, handshake and eye-off redrawn for 16 px (the last four the 11-11 glyph review named weak): care keeps its heart clear of an open hand; fish has an open V tail and a dot eye; handshake drops the tiny finger strokes and gets its first solid twin; eye-off breaks the outline where the slash crosses (#484).