Fix HIGH and MEDIUM frontend defects

Files pane
- F16: a drag-out released back inside the app no longer re-imports its own
  staged copy over the container original. An in-flight flag (cleared from the
  drag plugin's `onEvent` channel, with a watchdog) suppresses the drop and the
  "Drop files into …" hint, and an exact staged-path filter is the second line
  of defence — the `path|size|modified` cache could otherwise write a
  minutes-old snapshot over a file an agent had since rewritten.
- F17: a slow upload/rename no longer yanks the user back to the directory the
  operation started in. Every operation captures its target path and re-lists
  only if the user is still there; failures go to the toast host either way.
- The grid keeps keyboard focus. Roving tabindex (one tab stop, not one per
  row) plus focus restore after navigation, rename commit/cancel and Escape.
- Transient failures now surface in `ToastHost` (z-[60], persistent aria-live)
  instead of a `role="alert"` 300 rows down a scroller or behind a modal
  overlay. The inline error is kept only for the listing failure.
- `navigate` is sequenced by generation; "Save to host…" sets `busy`.
- Grid a11y: column headers, a text affordance for folder vs file, a live
  region that is mounted empty and announces completion, Label-in-Name fixed.
- FileViewerModal: the blob URL is released only once its replacement exists;
  the preview is a focusable, named, scrollable region.

Native drop routing
- New `lib/dropTarget.ts`: the hit test now refuses a drop while any
  `[aria-modal="true"]` dialog or `[data-blocks-drop]` overlay is up, and
  checks z-order where the environment can answer it. Shared by FilesTab and
  TerminalView; App's shutdown overlay opts in.

Disk
- A partially failed reclaim says so in words ("… — 2 of 5 failed"), not by hue
  alone.
- The scan/reclaim race is closed: every mutation retires an in-flight scan, so
  a scan can no longer repaint a pre-reclaim report plus a clickable plan of
  objects that are gone. Scan is disabled while working; the status is a live
  region; a failed destructive action keeps its dialog open and reports there.
- The "unknown" layer count gets a screen-reader fallback; `--text-disabled`
  no longer carries live information.

Terminal / OAuth
- After the toast is dismissed, a truncated heuristic guess can no longer fill
  the slot that an exact OSC 8 or relay URL occupied — the detector remembers
  every exact URL and drops any candidate that is a strict prefix of one.
- The prompt is reachable by keyboard: Ctrl+Shift+O jumps to the default
  action, Escape dismisses, focus returns to the terminal, and auto-dismiss
  holds off while focus is inside. It deliberately does not steal focus.
- UrlToast renders through `ui/Button` and `--shadow-overlay`.

Elsewhere
- AuthBridgeRow: a pushed `auth-bridge-changed` status always outranks an older
  awaited toggle result.
- The last two ad-hoc byte formatters route through `lib/formatBytes`.

Contract for the backend agent: `upload_file_to_container` refusing to
overwrite must satisfy `isFileExistsError` in `src/lib/uploadErrors.ts` (marker
`FILE_EXISTS`) and accept an `overwrite` argument; the frontend turns that into
an `ui/Modal` Replace/Skip prompt rather than a raw error string.

Tests: 536 -> 627 passing. `npm run build` and `npx tsc --noEmit` green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src/components/projects/ClaudeCodeSettingsEditor.test.tsx

@@ -119,5 +119,78 @@ describe("ClaudeCodeSettingsEditor", () => {
         "off",
       );
     });
+
+    /**
+     * Auto-scroll is the second inverted field and had no project-scope test at
+     * all — every assertion above rides on `session_recap_disabled`, so a
+     * `BOOLEAN_FIELDS` entry that lost its `invert` flag would be caught for
+     * one of the two and pass silently for the other. It is stored as
+     * `auto_scroll_disabled`, so every value here reads back the other way up.
+     */
+    describe("auto-scroll", () => {
+      const AUTO = "Auto-scroll";
+
+      it("starts on Global, which is not the same as on", () => {
+        // Claude Code scrolls by default, so an inheriting project *behaves*
+        // as on — but it has taken no position, and rendering it as "On" would
+        // make a later global change look like it had no effect.
+        renderEditor(null, "project");
+        expect((screen.getByLabelText(AUTO) as HTMLSelectElement).value).toBe("global");
+      });
+
+      it("stores the disabled sense in both directions", () => {
+        const onSave = renderEditor(null, "project");
+        const auto = screen.getByLabelText(AUTO);
+
+        fireEvent.change(auto, { target: { value: "off" } });
+        expect(onSave).toHaveBeenCalledWith(
+          expect.objectContaining({ auto_scroll_disabled: true }),
+        );
+
+        fireEvent.change(auto, { target: { value: "on" } });
+        expect(onSave).toHaveBeenCalledWith(
+          expect.objectContaining({ auto_scroll_disabled: false }),
+        );
+      });
+
+      it("hands the setting back to the global level when Global is chosen", () => {
+        // Back to no opinion, and with nothing else set that collapses the
+        // whole object to `null` — the value that means "adds nothing over the
+        // global settings".
+        const onSave = renderEditor(
+          { ...CLAUDE_CODE_DEFAULTS, auto_scroll_disabled: true },
+          "project",
+        );
+        fireEvent.change(screen.getByLabelText(AUTO), { target: { value: "global" } });
+        expect(onSave).toHaveBeenCalledWith(null);
+      });
+
+      it("reads a stored override back the right way up", () => {
+        renderEditor({ ...CLAUDE_CODE_DEFAULTS, auto_scroll_disabled: true }, "project");
+        expect((screen.getByLabelText(AUTO) as HTMLSelectElement).value).toBe("off");
+      });
+    });
+  });
+
+  /**
+   * The inverted fields store a *deviation*, so a stored `false` is the one
+   * value that means "the user deliberately re-enabled the default". Nothing
+   * asserted it: every existing test drives the `true` (turned off) direction
+   * or the `null` (untouched) one, and both scopes would still read correctly
+   * if the inversion were dropped from the `false` branch alone.
+   */
+  describe.each([
+    ["session_recap_disabled", "Session recap"] as const,
+    ["auto_scroll_disabled", "Auto-scroll"] as const,
+  ])("a stored false on %s", (key, label) => {
+    it("reads as On at project scope, not as Off", () => {
+      renderEditor({ ...CLAUDE_CODE_DEFAULTS, [key]: false }, "project");
+      expect((screen.getByLabelText(label) as HTMLSelectElement).value).toBe("on");
+    });
+
+    it("reads as on at global scope, where the control is a switch", () => {
+      renderEditor({ ...CLAUDE_CODE_DEFAULTS, [key]: false });
+      expect(screen.getByRole("switch", { name: label })).toBeChecked();
+    });
   });
 });