feat(files): add "This computer" local file browser

[roxi3906]

Summary

Adds a local-filesystem file browser ("This computer") as a sibling to the existing remote SSH browser. Local files open as standard preview-workbench tabs and render through the shared preview pipeline. Entry point is a new LOCAL section in the Files-panel Artifacts dropdown.

What's included

• Shared core (src/shared/local-fs.ts + tests): pure types, validateLocalPath, resolveLocalPath, sortLocalEntries, isSensitiveLocalPath, and the reserved LOCAL_BOOKMARKS_KEY.
• Main process (src/main/local-fs/): LocalFsService (list / preview / roots / reveal / openPath) backed by node:fs, entry-capped and realpath-canonicalized. The same instance also feeds the managed-preview resolver, so local images/PDFs stream through the same validated path.
• Bridge: window.api.localFs (5 methods); 'local' added to PreviewFileSource / ManagedPreviewSource; regenerated web api map.
• UI: LocalFileBrowser (back/up/refresh, editable address bar, Go-to with fixed Home + pin/unpin bookmarks, sensitive-file/dir confirm) and LocalFileHeaderActions (Reveal in Finder + Copy path / Open-with), replacing "Download" in the header and fallback surfaces for local files.

Security model

Deliberately "Home start, full-disk navigable" — paths are not confined to a storage root; validation rejects only malformed input (non-absolute / control chars) and realpath canonicalizes symlinks/...

The arbitrary-path read via source: 'local' is reachable only by the trusted main renderer: the open-science-preview:// protocol resolves opaque, owner-scoped resource IDs (never renderer-supplied paths), the HTML preview sandbox runs under default-src 'none'; connect-src 'none' with no preload, and local Office files skip the OOPIF pipeline. acquire/readRange/release are isolated per ownerId (webContents).

Sensitive-path warning covers credential directories (.ssh / .aws / .gnupg) on entry, dotenv files, and suffix-less secret files (SSH private keys, cloud credentials, .pgpass, .p12/.pfx).

Testing

• tsc --noEmit on both node and web projects — clean.
• ESLint on all changed files — clean.
• Vitest: shared local-fs + main local-fs/service suites pass (20 tests, incl. new suffix-less-secret cases); previously verified managed-preview / office-preview suites unaffected.
• Renderer components (LocalFileBrowser, LocalFileHeaderActions) have no unit tests — verified via typecheck/lint only.

Deferred / not included

• Save as artifact from a local preview (mirrors the still-unwired remote "Add to project").
• "Add local folder…" entry is present but disabled ("Soon").
• Local Office files open in the OS default app rather than rendering inline (the in-app LibreOffice pipeline resolves managed paths only); text/code/CSV/JSON/Markdown/PDF/images render inline.
• Header is a compact 32px strip, not the taller machine-chip + breadcrumb layout from docs/local-artifacts-mockup.html.
• "Reveal in Finder" label is macOS-specific.

🤖 Generated with Claude Code