Add comment sidebar and pin tool

[emlcpfx]

Builds on #15 (comment model). This is the user-facing half: a Comments panel and a pin tool.

What it adds

• widgets/commentpanel.py - comment list grouped by frame. Click a row to seek to it, tick the box to mark it done, delete the selection, or type a frame-level note. Pin numbers in the list match the numbers drawn inside the on-frame markers.
• Comment tool in the viewer toolbar. Click the frame, type the note, and it is pinned at that point.
• View > Comments Panel (Ctrl+M). Opens to a usable width the first time it is shown; hides with the rest of the chrome in fullscreen.

The panel is a pure view over Sketch.comments and holds no state of its own, so the list and the markers drawn on the frame cannot drift apart. Every edit goes straight to the sketch and is persisted to the note sidecar from #10.

Two crashes this avoids

A {type: comment} stroke. Sketch.mousePressEvent now returns early for the comment tool. Without that, a click would create a stroke of an unknown type, which renders as nothing and is silently discarded by erase() - which only re-appends the stroke types it recognizes. Same trap the arrow tool hit in #13.

A use-after-free on the done checkbox. Toggling a comment done restyles its row in place. Rebuilding the tree from inside itemChanged destroys the very item Qt is still emitting the signal for, and takes the whole process down with an access violation. It surfaced as an intermittent crash in the test suite (~1 run in 3) before being tracked down. test_checkbox_toggles_done_on_the_sketch asserts the row is the same object afterwards, so a future refactor that reintroduces the rebuild fails loudly instead of crashing at random.

Tests

15 new tests, 48 on the branch, all passing headless:

• grouping, ordering, counts, pin numbering, empty and unbound states
• click-to-seek, done-toggle, delete, add-note (including blank text and no-current-frame)
• refresh must not emit comments_changed (rebuilding sets check states; that is not a user edit)
• the comment tool emits the normalized hit point and creates no stroke; the pencil tool still draws

ViewerWidget is a QOpenGLWidget and cannot create a context under the offscreen platform - constructing one crashes Qt on teardown intermittently, on Linux CI too. The real ViewerWidget.mousePressEvent is therefore exercised against a stand-in carrying only the attributes it reads. The code under test is the shipped code; only the GL shell is stubbed.

Needs a look in the running app

The logic is covered, but the visual result is not: open a clip, pick the Comment tool, click the frame, and confirm the pin lands where you clicked and the note shows up in the sidebar.

Depends on #15, #10, #9, #7.

[emlcpfx]

Superseded by #18, which landed the same feature with a fuller UI (filters, resolve/reopen). Closing in favour of it — no point carrying two comment sidebars.

Two things from this branch worth folding into #18 if they aren't already covered, because both are real crashes rather than polish:

1. Sketch.mousePressEvent should return early for the comment tool. Without that guard, a comment-tool click falls through to stroke creation and stores a {"type": "comment"} stroke. It renders as nothing, and then erase() silently discards it — erase() rebuilds the frame's stroke list and only re-appends the stroke types it recognises, so any unhandled type vanishes on the first eraser stroke anywhere on the frame. This is the same trap the arrow tool hit in #13.

2. Never rebuild the comment list from inside a QTreeWidget.itemChanged handler. Clearing the tree there destroys the very item Qt is still emitting the signal for — a use-after-free that takes the whole process down with an access violation. It only reproduces intermittently (roughly one run in three), so it presents as a flaky test rather than a crash, which is exactly what makes it dangerous. The fix is to restyle the affected row in place; a done-toggle doesn't change the row count, so there's nothing to rebuild anyway.

If #18's resolve/reopen path refreshes its list inside that signal, it has bug 2. Worth a look either way.

The CSV export in #19 doesn't depend on this branch — it only needs the comment model from #15 and the timecode from #12, both already merged. I've rebased it onto main accordingly.