feat(files): add repository-aware viewer

[Lint111]

Summary

Add a repository-aware File Viewer that follows the active Codeman session and remains usable on phones.

The PR is intentionally split into two commits:

1. feat(files): add authorized repository browsing
   • discovers the repository and linked worktrees from the session path
   • exposes bounded repository overview, commit detail, and file diff routes
   • extends existing file/preview routes with an opaque worktree scope
   • rejects symlink escapes, binary/oversized previews, forged scopes, and worktrees outside the authenticated workspace
2. feat(files): add repository-aware viewer
   • adds Files, Changes, and History tabs
   • renders compact/full diffs and lazy commit details
   • synchronizes viewer ownership immediately on session changes
   • prevents stale async loads from replacing the newly selected session
   • adds an authenticated local-session work-path editor
   • provides a full-screen phone preview with stable diff gutters

User Experience

• File Viewer defaults to the active session's current repository/worktree.
• Switching Codeman sessions immediately resets the viewer to that session's current scope.
• Sibling worktrees can be selected without sending arbitrary filesystem paths from the browser.
• Current changes show status, path, staging state, and line counts.
• Commit history expands lazily and opens committed-file diffs.
• Diff preview can switch between compact patch and full-file modes.
• The opt-in File Viewer header action remains available on mobile.
• A session can reassign its Codeman work-path metadata when a restored agent reports a more accurate repository path.

Work-path reassignment updates Codeman metadata, parsers, watcher roots, and persisted mux state. It intentionally does not change the cwd of an already-running child process.

Security

• Repository scope ids are resolved only on the server.
• Every selected root is checked with the authenticated workspace policy.
• Unauthorized linked worktrees are removed from repository overview responses.
• File resolution uses real paths and rejects symlink escapes.
• Diff previews bound text size and do not return binary bodies.
• Remote and container sessions cannot use local work-path reassignment.

Validation

• npx vitest run --config config/vitest.config.ts test/git-repository-browser.test.ts test/routes/file-routes-repository.test.ts
  • 8 tests passed
• npx vitest run --config config/vitest.config.ts test/git-repository-browser.test.ts test/routes/file-routes-repository.test.ts test/routes/session-routes.test.ts test/tmux-manager.test.ts
  • 139 tests passed
• npx vitest run --config test/mobile/vitest.config.ts test/mobile/file-viewer.test.ts
  • 5 Playwright-backed tests passed
• npm run check:frontend-syntax
  • 26 frontend files passed
• npm run build
  • passed

Scope

This PR does not include terminal input, mobile navigation controls, viewport sizing, terminal-history streaming, response-viewer behavior, hook lifecycle, notifications, shutdown, case actions, or animation settings. Those are being reviewed as independent feature PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.