Add damrs_editor, and find that core already did half of it

Add damrs_editor, and find that core already did half of it Inserting a damrs asset as a media entity needs nothing from this connector. damrs_media makes an ordinary media type, so CKEditor 5's Media Library button and core's media_embed filter handle it — checked rather than assumed: a tag pointing at a damrs item renders our signed URL today. Writing a CKEditor plugin for that would have been re-implementing something that already worked, which is worth knowing before writing it rather than after. What core cannot do is resolve a pasted URL. Its OEmbed source discovers providers through the public registry and fetches with no credential, and damrs's oEmbed is authenticated on purpose: an unauthenticated endpoint that turns an asset id into a filename, a size and a preview is an enumeration API for somebody's whole library. So the filter makes that call server-side with the connector's key, which is the arrangement damrs's own oEmbed module documents as its expectation. Links only, never bare text: an author writing about the DAM has to be able to quote an asset URL without it turning into a picture, and a filter that cannot be escaped is one people route around. A photo becomes an image; anything else becomes a thumbnail link rather than a player this has no code for. A body with no damrs link costs no request at all, which matters for a filter that runs on every filtered field on a site. **The cache-lifetime trap, in its third form.** damrs reports a cache_age deliberately shorter than the signed URL inside the response, and a filtered body is cached separately from the formatter's render array. With several embeds in one body the shortest age wins: one expired URL is enough to break the page. **A harness bug that made a green suite meaningless.** The HTTP client was replaced in setUp(), which is too late whenever anything has already caused damrs.client to be constructed — the client keeps the real Guzzle it was handed, the queued mock is never consumed, and the call fails a real DNS lookup and returns NULL as though damrs had refused. Four tests failed for that reason and none of them was about what it appeared to be. Replacing the service in register(), at container-build time, is the fix; all three kernel suites now do it, and the media and sync suites were genuine either way because they assert on successful mocked responses. 25 kernel tests, 32 unit tests, phpcs clean.