Fix rebuild blocking FastAPI event loop

Switch /rebuild endpoint from subprocess.run (blocks event loop) to
asyncio.create_subprocess_exec, preventing auth failures on concurrent
requests during build. Update site submodule pointer.

edit/server.py

@@ -2,11 +2,11 @@
 
 from __future__ import annotations
 
+import asyncio
 import os
 import re
 import secrets
 import sqlite3
-import subprocess
 import time
 from contextlib import contextmanager
 from pathlib import Path
@@ -248,21 +248,25 @@ async def delete_story(slug: str, user: dict = Depends(require_auth)) -> JSONRes
 
 @app.post("/rebuild")
 async def rebuild(user: dict = Depends(require_auth)) -> JSONResponse:
-    """Trigger an astro build of the site."""
+    """Trigger an astro build of the site (non-blocking)."""
     try:
-        result = subprocess.run(
+        proc = await asyncio.create_subprocess_exec(
-            ["npm", "run", "build"],
+            "npm", "run", "build",
             cwd=site_dir,
-            capture_output=True,
+            stdout=asyncio.subprocess.PIPE,
-            text=True,
+            stderr=asyncio.subprocess.PIPE,
-            timeout=120,
         )
-        return JSONResponse({
+        try:
-            "success": result.returncode == 0,
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=120)
-            "stdout": result.stdout[-3000:] if result.stdout else "",
+        except asyncio.TimeoutError:
-            "stderr": result.stderr[-3000:] if result.stderr else "",
+            proc.kill()
-        })
-    except subprocess.TimeoutExpired:
             raise HTTPException(504, "Build timed out after 120s")
+        return JSONResponse({
+            "success": proc.returncode == 0,
+            "stdout": stdout.decode()[-3000:] if stdout else "",
+            "stderr": stderr.decode()[-3000:] if stderr else "",
+        })
+    except HTTPException:
+        raise
     except Exception as e:
         raise HTTPException(500, str(e))