Fix HIGH and MEDIUM frontend defects

Files pane
- F16: a drag-out released back inside the app no longer re-imports its own
  staged copy over the container original. An in-flight flag (cleared from the
  drag plugin's `onEvent` channel, with a watchdog) suppresses the drop and the
  "Drop files into …" hint, and an exact staged-path filter is the second line
  of defence — the `path|size|modified` cache could otherwise write a
  minutes-old snapshot over a file an agent had since rewritten.
- F17: a slow upload/rename no longer yanks the user back to the directory the
  operation started in. Every operation captures its target path and re-lists
  only if the user is still there; failures go to the toast host either way.
- The grid keeps keyboard focus. Roving tabindex (one tab stop, not one per
  row) plus focus restore after navigation, rename commit/cancel and Escape.
- Transient failures now surface in `ToastHost` (z-[60], persistent aria-live)
  instead of a `role="alert"` 300 rows down a scroller or behind a modal
  overlay. The inline error is kept only for the listing failure.
- `navigate` is sequenced by generation; "Save to host…" sets `busy`.
- Grid a11y: column headers, a text affordance for folder vs file, a live
  region that is mounted empty and announces completion, Label-in-Name fixed.
- FileViewerModal: the blob URL is released only once its replacement exists;
  the preview is a focusable, named, scrollable region.

Native drop routing
- New `lib/dropTarget.ts`: the hit test now refuses a drop while any
  `[aria-modal="true"]` dialog or `[data-blocks-drop]` overlay is up, and
  checks z-order where the environment can answer it. Shared by FilesTab and
  TerminalView; App's shutdown overlay opts in.

Disk
- A partially failed reclaim says so in words ("… — 2 of 5 failed"), not by hue
  alone.
- The scan/reclaim race is closed: every mutation retires an in-flight scan, so
  a scan can no longer repaint a pre-reclaim report plus a clickable plan of
  objects that are gone. Scan is disabled while working; the status is a live
  region; a failed destructive action keeps its dialog open and reports there.
- The "unknown" layer count gets a screen-reader fallback; `--text-disabled`
  no longer carries live information.

Terminal / OAuth
- After the toast is dismissed, a truncated heuristic guess can no longer fill
  the slot that an exact OSC 8 or relay URL occupied — the detector remembers
  every exact URL and drops any candidate that is a strict prefix of one.
- The prompt is reachable by keyboard: Ctrl+Shift+O jumps to the default
  action, Escape dismisses, focus returns to the terminal, and auto-dismiss
  holds off while focus is inside. It deliberately does not steal focus.
- UrlToast renders through `ui/Button` and `--shadow-overlay`.

Elsewhere
- AuthBridgeRow: a pushed `auth-bridge-changed` status always outranks an older
  awaited toggle result.
- The last two ad-hoc byte formatters route through `lib/formatBytes`.

Contract for the backend agent: `upload_file_to_container` refusing to
overwrite must satisfy `isFileExistsError` in `src/lib/uploadErrors.ts` (marker
`FILE_EXISTS`) and accept an `overwrite` argument; the frontend turns that into
an `ui/Modal` Replace/Skip prompt rather than a raw error string.

Tests: 536 -> 627 passing. `npm run build` and `npx tsc --noEmit` green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src/components/projects/home/FileViewerModal.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import type { FileEntry } from "../../../lib/types";
 import { readContainerFile } from "../../../lib/tauri-commands";
 import Button from "../../ui/Button";
@@ -40,11 +40,28 @@ type Preview =
 export default function FileViewerModal({ projectId, entry, onClose, onSaveToHost }: Props) {
   const [preview, setPreview] = useState<Preview>({ kind: "loading" });
 
+  /**
+   * The object URL currently on screen.
+   *
+   * This used to be an effect-local variable revoked from the effect's own
+   * cleanup, which runs *before* the replacement effect body — so switching
+   * entries (or any re-run of the effect for the same entry) released the URL
+   * the `<img>` was still pointing at, and a blank image was the result until
+   * the new read landed. If the new read failed, it stayed blank. So the
+   * hand-over is explicit instead: a URL is revoked only once its replacement
+   * exists, and unmount is what releases the last one.
+   */
+  const objectUrlRef = useRef<string | null>(null);
+
+  /** Release the previous URL now that something else is on screen. */
+  const replaceObjectUrl = (next: string | null) => {
+    const previous = objectUrlRef.current;
+    objectUrlRef.current = next;
+    if (previous && previous !== next) URL.revokeObjectURL(previous);
+  };
+
   useEffect(() => {
     let cancelled = false;
-    // Tracked separately from `preview` so cleanup can revoke it without
-    // depending on which state the component ended up in.
-    let objectUrl: string | null = null;
 
     (async () => {
       try {
@@ -58,16 +75,20 @@ export default function FileViewerModal({ projectId, entry, onClose, onSaveToHos
           // A truncated image is not a smaller image, it is a broken one.
           if (result.truncated) {
             setPreview({ kind: "too-large" });
+            replaceObjectUrl(null);
             return;
           }
           const blob = new Blob([bytes], { type: imageMimeFor(entry.name) ?? "image/png" });
-          objectUrl = URL.createObjectURL(blob);
-          setPreview({ kind: "image", url: objectUrl });
+          const url = URL.createObjectURL(blob);
+          // The replacement is in hand, so the previous one can go.
+          setPreview({ kind: "image", url });
+          replaceObjectUrl(url);
           return;
         }
 
         if (looksBinary(bytes)) {
           setPreview({ kind: "unsupported" });
+          replaceObjectUrl(null);
           return;
         }
 
@@ -78,6 +99,7 @@ export default function FileViewerModal({ projectId, entry, onClose, onSaveToHos
           shownBytes: bytes.length,
           trueSize: result.size,
         });
+        replaceObjectUrl(null);
       } catch (e) {
         if (!cancelled) setPreview({ kind: "error", message: String(e) });
       }
@@ -85,10 +107,19 @@ export default function FileViewerModal({ projectId, entry, onClose, onSaveToHos
 
     return () => {
       cancelled = true;
-      if (objectUrl) URL.revokeObjectURL(objectUrl);
     };
   }, [projectId, entry.name, entry.path]);
 
+  // The bytes are released when the dialog goes, which is the whole reason the
+  // preview is a `blob:` URL rather than a `data:` one.
+  useEffect(
+    () => () => {
+      if (objectUrlRef.current) URL.revokeObjectURL(objectUrlRef.current);
+      objectUrlRef.current = null;
+    },
+    [],
+  );
+
   const footer = (
     <>
       <Button
@@ -143,7 +174,18 @@ export default function FileViewerModal({ projectId, entry, onClose, onSaveToHos
               Showing the first {formatBytes(preview.shownBytes)} of {formatBytes(preview.trueSize)}.
             </p>
           )}
-          <pre className="whitespace-pre-wrap break-words font-mono text-xs text-[var(--text-primary)]">
+          {/* Focusable, and its own scroll container, because a megabyte of
+              text in an unfocusable `<pre>` is reachable by mouse wheel and by
+              nothing else — no PageDown, no arrows, no keyboard at all. A
+              scrollable region needs an accessible name to be worth landing
+              on, hence the role and label. No `focus:outline-none`: the global
+              `:focus-visible` ring is what says where the caret went. */}
+          <pre
+            tabIndex={0}
+            role="region"
+            aria-label={`${entry.name} contents`}
+            className="max-h-[60vh] overflow-auto whitespace-pre-wrap break-words font-mono text-xs text-[var(--text-primary)]"
+          >
             {preview.text}
           </pre>
         </>