Replace the per-document legend

Overwrites grounding.graph.legend wholesale. The rest of the graph (network, annotations, arrows, subgraphs) is preserved by loading the current graph, swapping the legend field, and re-saving. Each entry's source_crop_url must be an inline image data URL (≤32 KB), stored as sent, or a URL on any host whose path names one of this document's crops under users/<owner>/<document>/legend_crops/, stored as a link the server signs from that crop's key. A storage backend whose links are not re-signed on read (Azure) accepts only data URLs.