#401 Add Web file downloads and bounded image previews

[OldKrab]

Problem

Web file links could open an unsupported preview with no way to retrieve the file. Large photos also failed preview, and a parent rerender could release a viewer handle while leaving its preview visible, causing Download to report a false “File not found”.

Changes

• Add Download to Web File Viewer tabs for every readable regular file, independently of preview. Stream current filesystem bytes and preserve the referenced basename, including Unicode and symlink aliases.
• Keep downloads authenticated and bound to the owning client's viewer handle, with a readability check and retry before browser handoff. Desktop and VS Code download affordances remain unchanged.
• Generate bounded, orientation-correct image previews (2048-pixel edge, 2 MiB payload), preserving transparency and original downloads. Keep small animations intact; reduced animations show the first frame. Run conversion outside the shared protocol lock with bounded admission and decoder budgets.
• Keep viewer handles alive across ordinary parent renders. Update the accepted viewer ADRs and generated bindings.

Closes #401.

Verification

Passed during implementation: 198 protocol boundary tests, 12 viewer tests, additional Markdown/file-reference tests, and three desktop/phone browser scenarios covering current bytes, Unicode symlinks, missing-file retry, large-photo preview, zoom, and original downloads. Target deployment and readiness were verified.

• npm run ci — local checks and tests passed; the aggregate build step could not find the binary because the Rust target directory was redirected. GitHub production build passed on the initial PR revision.
• No credentials, personal domains, real home paths, or local artifacts are included
• Protocol bindings were regenerated when protocol types changed

CI follow-up: replaced the config-catalog ordering test's polling and timed receive with a two-phase barrier and worker join. The synchronized test passed 20 consecutive runs; the full Rust workspace suite, Clippy, and formatting passed. AGENTS.md now requires synchronization primitives for ordering tests instead of sleeps or short deadlines.