File Viewer: edit mode for text files (edit + save in the viewer)

[Ark0N]

Closes #212.

The file-preview overlay can now edit workspace text files in place, phone-first: the agent writes a file, you review it in the viewer, tweak two lines, save, and tell the agent to continue. Design doc: docs/file-viewer-edit-plan.md; invariants: docs/architecture-invariants.md#file-viewer-edit-mode.

What's in here

Backend (src/web/routes/file-routes.ts, policy in src/config/file-editing.ts)

• GET /api/sessions/:id/file-content?edit=1: read-for-edit that never truncates (the plain preview truncates to 500 lines; saving such a buffer would silently delete the rest, so the editor always loads through this path), 512KB cap with a 413 over it, returns the sha256 hash + detected eol the client echoes back.
• PUT /api/sessions/:id/file-content: edit-in-place only. There is no O_CREAT anywhere in the handler, which makes "never create, never delete" structural rather than a convention.
• Confinement inherits the read path (realpath + workspace boundary, ownership via findSessionOrFail) and adds: sensitive-path + attachment-guard blocklists, a .git/ subtree deny (hooks are code execution), and an extension allowlist (svg and env deliberately excluded in v1).
• Optimistic concurrency by content hash (not mtime): stale baseHash is a 409 CONFLICT unless force:true.
• Atomic writes: wx temp + fchmod + fsync + rename in the target directory, closing the validate-then-write TOCTOU window; wx cannot follow a pre-existing symlink and rename() replaces a symlink final component instead of following it. In-workspace symlinks write through to their target (matching what tapping the file shows).
• Corruption guards: NUL sniff + UTF-8 round-trip compare (refuses binary and latin-1, whose U+FFFD decode would destroy the original bytes on save), and server-side EOL re-application so a textarea's LF normalization cannot turn a two-line edit of a CRLF file into a whole-file diff.

Frontend (panels-ui.js, overlay markup + styles)

• Edit (pencil) button on text previews, shown only when the server advertises editable.
• Textarea editor with Save/Cancel, dirty indicator, discard-confirm on cancel/close, and a conflict dialog offering overwrite when the file changed on disk mid-edit.
• Phone: full-bleed window sized by --app-height (tracks the OS keyboard via the existing KeyboardHandler), 16px editor font (iOS zoom guard), no autofocus.
• zh-CN strings for the new chrome.

Testing

• test/file-editing-policy.test.ts: 13 pure policy tests.
• test/routes/file-write-routes.test.ts: 27 route tests that deliberately do not mock node:fs; they run against a real temp workspace so symlink escape, write-through, mode preservation, CRLF round-trip, 409/force, multi-user scoping, and the no-create property are exercised for real.
• Full npm run test:ci sweep: 3942 passed, 0 failed.
• End-to-end on an isolated beta instance: a 39-check curl matrix (traversal, symlink escape, .env/.git, binary/latin-1, size caps, conflict/force, CRLF bytes, file mode), a Playwright desktop flow (real clicks and typing through the File Viewer, bytes asserted on disk, live conflict triggered by rewriting the file externally mid-edit), and a 393px phone profile (full-bleed layout, 16px font, reachable Save bar, typed save verified on disk).

Out of scope per the issue: creation/deletion/rename, syntax highlighting, and editing through Docker/remote overlays (Docker cases work naturally via the bind mount; remote SSH cases fail closed with the same 404 the read routes give today).