fix(trips): remaining publish-toggle review findings

- resolveTripChild now asserts the resolved page uses the trip template, so a
  non-trip direct child of /trips could never be toggled through this endpoint
  (P3 adversarial).
- apiSend gains an optional timeoutMs (AbortController); trip-publish passes 10s
  so a hung toggle can't leave the switch stuck aria-busy. post-form omits it,
  keeping media uploads unbounded (P2 reliability).
- trips.html.twig reuses trip.html.twig's one-line active-trip slug match
  instead of a bespoke 3-branch OR (P2 maintainability).
- Draft-badge amber is now a --color-draft-accent token shared by the trip and
  journal badges instead of a twice-hardcoded #E0A458 literal (P3).

Rebuilt js/trip-publish.js and js/post/post-form.js (shared api-utils change).
PHP lint clean; trip-publish suite 10/10; post suite unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn

themes/intotheeast/templates/trips.html.twig

@@ -19,13 +19,12 @@
     {% set stories_page = grav.pages.find(trip.route ~ '/stories') %}
     {% set journal_count = dailies_page ? dailies_page.children.published()|length : 0 %}
     {% set story_count = stories_page ? stories_page.children.published()|length : 0 %}
-    {# Robust active-trip match: site.active_trip may be a full route
-       (/trips/x) or a bare slug — normalise both sides before comparing so the
-       R12 confirm never silently drops (both forms exist in helpers.js /
-       cache-on-save). #}
-    {% set active = (config.site.active_trip ?? '')|trim('/') %}
-    {% set trip_route = trip.route|trim('/') %}
-    {% set is_active = active != '' and (active == trip_route or active == ('trips/' ~ trip.slug) or active == trip.slug) %}
+    {# Active-trip match: site.active_trip may be a full route (/trips/x) or a
+       bare slug — normalise to its last segment and compare to the trip slug,
+       the same one-liner trip.html.twig uses, so the R12 confirm never silently
+       drops. #}
+    {% set active_trip_slug = (grav.config.site.active_trip|default(''))|split('/')|last %}
+    {% set is_active = active_trip_slug != '' and trip.slug == active_trip_slug %}
     {# The wrapper is a positioned container so the owner toggle can overlay the
        cover as a SIBLING of the navigating <a> (KTD6) — and it exists even for a
        coverless draft, giving the toggle an anchor whether or not the cover macro