v0.8.0 — CLAUDE.md editor + the real fix for web-UI 'CSRF'

v0.8.0 — CLAUDE.md editor + the real fix for "CSRF" on every web-UI action

Fixed (critical)

• Every web-UI mutation returned "CSRF". Add / edit / delete / supersede / re-scope, the Links
  page, and the review queue all failed with an opaque CSRF error. Root cause: the JavaScript sent
  the request body as FormData (which the browser encodes as multipart/form-data), but the server
  parses the body with urllib.parse.parse_qs, which only understands
  application/x-www-form-urlencoded. The csrf field was therefore never extracted, so the check
  always failed. This was latent since the PHP→Python rewrite in v0.7.0 (PHP's $_POST parsed
  multipart automatically; parse_qs does not). The JS now sends URLSearchParams (urlencoded), which
  the server parses correctly. Verified end-to-end. Add/delete from the web UI work again.
  (This supersedes the v0.7.4 "persist the CSRF token" change as the explanation — that was a
  misdiagnosis of the same symptom; persisting the token across restarts is still a good thing, but it
  was never the cause.)

New

• CLAUDE.md editor page. A new "CLAUDE.md" nav page shows the CLAUDE.md files Claude Code loads for
  the selected project — your user-global ~/.claude/CLAUDE.md, the monorepo-root one, and the
  project's own — right next to your memories. View, Edit, Save. Saving writes a timestamped .bak
  next to the file (collision-proof, never clobbered), writes atomically (temp + os.replace, so a
  partial write can't truncate the file), and refuses to save an empty file. The target path is always
  resolved server-side from a safe key — never a path from the browser — so the editor cannot read or
  write outside those files (path-traversal and symlink-escape both rejected). Adversarially reviewed.

Upgrade: git pull, restart the web server, reload the tab.