feat: Allowed Directories management panel

[Copilot]

GridWatch had no UI for managing the Copilot agent's allowed-directories list. This adds a dedicated DIRS page with full CRUD, search, auto-refresh, and security hardening consistent with the MCP/LSP pages.

Storage

Persists to ~/.copilot/gridwatch-allowed-dirs.json:

{ "directories": [{ "path": "/absolute/path", "addedAt": "2024-01-01T00:00:00.000Z" }] }

IPC surface (electron/main.ts + preload.ts)

• dirs:get-all — returns AllowedDirectory[] with live exists flag; 10 s in-memory cache
• dirs:add — opens native folder-picker dialog, validates, appends, invalidates cache
• dirs:remove — validates path, removes entry, deletes file when list becomes empty
• app:open-item-folder extended with 'dirs' case → reveals config file in Finder/Explorer

Security

• Prototype pollution guard (PROTOTYPE_POLLUTION_KEYS)
• Shell metacharacter blocklist (; | & \ $ ( ) > < \0 %`)
• Absolute-path enforcement + explicit .. segment check (cross-platform, splits on both / and \)
• 4096-char max path length
• isValidDirPath applied inside readAllowedDirs so tampered JSON can't inject invalid paths
• fs.statSync confirms selection is a directory before persisting

UI (DirsPage.tsx / DirsPage.module.css)

• List/detail split layout consistent with Skills, MCP, LSP, Agents pages
• ⊟ DIRS nav entry added after AGENTS
• EXISTS / NOT FOUND badges; error banner with dismiss (including openItemFolder failures)
• 30 s auto-refresh interval + refreshKey prop; + ADD button triggers folder-picker

[faesel]

Closed — branch merged directly to main in v0.31.0