[httpsphl]

Problem

A bot that made a file (a PDF report, in the case that prompted this) left the owner hunting for it in the folder on their computer. Nothing in the app showed what it had created.

Change

Daemon (spec 8.4)

• files.list {botId}: files in the crew's work folder and the bot's folder that changed after the bot was created (so the owner's own files in a chosen folder do not show up), plus every file the bot's Write/Edit calls touched, even outside those folders. Bounded walk (depth, entries), no links, no hidden/generated folders, newest first, at most 200.
• files.read {botId, path}: bytes for a preview, only for paths the list could show; anything else, relative paths and .. climbs are not_found. Over 20 MiB is refused.
• ToolItem.file records the full path of a Write/Edit/NotebookEdit call, which the clipped 4 KB input could not always give.

App (spec 15.1, 15.2)

• A Files button in the bot header opens a panel to the right of the chat: icon by type, name, folder, size, "5 min ago". A click previews images, PDFs, markdown and text in the panel; other types say there is no preview.
• Open uses the program Windows picks; Show in folder opens Explorer with the file selected. open_file only accepts document, image, sound and video extensions, so it can never run a program or script.
• The list refreshes on open, every 4 s while the bot works, and once when it stops. With the panel closed, the button shows how many files appeared since the owner last looked.
• Text in English, Portuguese and Spanish.

Tested

cargo fmt, clippy -D warnings, cargo test --workspace and pnpm check (113 tests) pass. New tests: the store query, the folder walk, an end-to-end files.list/files.read including refused paths, the extension allowlist, and the panel (list, preview, open/reveal, empty, new-file count). Checked by eye in the dev preview.

Manual steps with the real app

1. pnpm tauri dev, ask a bot to make a PDF with a script and a markdown file with Write: both should appear in the panel (Files button), the markdown with a preview.
2. Open the PDF in the panel. Not verified in WebView2 (it goes through <iframe src="blob:...">, and the CSP now allows frame-src blob:); if it does not render, "Open" still works and the preview needs another route (spec 19).
3. Open on a PDF, Show in folder on any file.

Stacked on nothing: independent of the status fix in #26.