upsert-patch: a couple of open SECURITY; SHOULD validation TODOs (flagging, not fully verified)

Flagging this one lightly and honestly: I read the comments but did not verify the behavior beyond that, so treat it as a pointer rather than a finding.

In the upsert-patch code path there are a couple of validation gaps still marked SECURITY; SHOULD in the source:

• alt-page-id (pageIdsByAltIds) validation is flagged as not-yet-done;
• post/group cycle checks in the upsert path are likewise still on the TODO list.

Why it's worth mentioning to a self-hoster at all: these paths are reachable with a site secret. On a single-owner instance that's not a meaningful attack surface — you'd be attacking yourself. But if a site secret ever leaks, or in a multi-tenant context, unvalidated alt-ids or an unchecked cycle could turn into corrupted state rather than a clean rejection. So it's a completeness / robustness note, low urgency.

Magnus, these are your own SECURITY; SHOULD comments — I'm just surfacing them so they don't get lost. Source-read only, at commit f220a7d9f; I did not construct a repro.