Fix HIGH and MEDIUM frontend defects

Files pane
- F16: a drag-out released back inside the app no longer re-imports its own
  staged copy over the container original. An in-flight flag (cleared from the
  drag plugin's `onEvent` channel, with a watchdog) suppresses the drop and the
  "Drop files into …" hint, and an exact staged-path filter is the second line
  of defence — the `path|size|modified` cache could otherwise write a
  minutes-old snapshot over a file an agent had since rewritten.
- F17: a slow upload/rename no longer yanks the user back to the directory the
  operation started in. Every operation captures its target path and re-lists
  only if the user is still there; failures go to the toast host either way.
- The grid keeps keyboard focus. Roving tabindex (one tab stop, not one per
  row) plus focus restore after navigation, rename commit/cancel and Escape.
- Transient failures now surface in `ToastHost` (z-[60], persistent aria-live)
  instead of a `role="alert"` 300 rows down a scroller or behind a modal
  overlay. The inline error is kept only for the listing failure.
- `navigate` is sequenced by generation; "Save to host…" sets `busy`.
- Grid a11y: column headers, a text affordance for folder vs file, a live
  region that is mounted empty and announces completion, Label-in-Name fixed.
- FileViewerModal: the blob URL is released only once its replacement exists;
  the preview is a focusable, named, scrollable region.

Native drop routing
- New `lib/dropTarget.ts`: the hit test now refuses a drop while any
  `[aria-modal="true"]` dialog or `[data-blocks-drop]` overlay is up, and
  checks z-order where the environment can answer it. Shared by FilesTab and
  TerminalView; App's shutdown overlay opts in.

Disk
- A partially failed reclaim says so in words ("… — 2 of 5 failed"), not by hue
  alone.
- The scan/reclaim race is closed: every mutation retires an in-flight scan, so
  a scan can no longer repaint a pre-reclaim report plus a clickable plan of
  objects that are gone. Scan is disabled while working; the status is a live
  region; a failed destructive action keeps its dialog open and reports there.
- The "unknown" layer count gets a screen-reader fallback; `--text-disabled`
  no longer carries live information.

Terminal / OAuth
- After the toast is dismissed, a truncated heuristic guess can no longer fill
  the slot that an exact OSC 8 or relay URL occupied — the detector remembers
  every exact URL and drops any candidate that is a strict prefix of one.
- The prompt is reachable by keyboard: Ctrl+Shift+O jumps to the default
  action, Escape dismisses, focus returns to the terminal, and auto-dismiss
  holds off while focus is inside. It deliberately does not steal focus.
- UrlToast renders through `ui/Button` and `--shadow-overlay`.

Elsewhere
- AuthBridgeRow: a pushed `auth-bridge-changed` status always outranks an older
  awaited toggle result.
- The last two ad-hoc byte formatters route through `lib/formatBytes`.

Contract for the backend agent: `upload_file_to_container` refusing to
overwrite must satisfy `isFileExistsError` in `src/lib/uploadErrors.ts` (marker
`FILE_EXISTS`) and accept an `overwrite` argument; the frontend turns that into
an `ui/Modal` Replace/Skip prompt rather than a raw error string.

Tests: 536 -> 627 passing. `npm run build` and `npx tsc --noEmit` green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src/components/projects/home/config/AuthBridgeRow.test.tsx

@@ -101,6 +101,80 @@ describe("AuthBridgeRow", () => {
     expect(screen.queryByText(/Port 1:/)).not.toBeInTheDocument();
   });
 
+  /**
+   * The two halves of this row disagree about *when*, not about *what*.
+   *
+   * `set_auth_bridge_enabled` resolves with a status sampled as it returned;
+   * the poller's event carries one sampled afterwards. Writing the awaited
+   * value unconditionally therefore rolls the row back in time whenever the
+   * two overlap — the row says "Watching" while a port is bound, which is the
+   * exact silent failure the event subscription was added to end. These two
+   * hold the ordering down from both the resolve and the reject side.
+   */
+  describe("a pushed event outranks an older awaited result", () => {
+    /** A toggle that will not settle until the test says so. */
+    function deferToggle() {
+      let settle!: (s: AuthBridgeStatus) => void;
+      let fail!: (e: unknown) => void;
+      setAuthBridgeEnabled.mockImplementation(
+        () =>
+          new Promise<AuthBridgeStatus>((resolve, reject) => {
+            settle = resolve;
+            fail = reject;
+          }),
+      );
+      return { settle: (s: AuthBridgeStatus) => settle(s), fail: (e: unknown) => fail(e) };
+    }
+
+    const BRIDGING: AuthBridgeStatus = {
+      enabled: true,
+      active_ports: [{ port: 54545, family: "v4", bridged_at: "", ipv6_warning: null }],
+      conflicts: [],
+    };
+
+    async function startToggleThenPush() {
+      render(<AuthBridgeRow project={project} />);
+      await waitFor(() => expect(getAuthBridgeStatus).toHaveBeenCalled());
+      await waitFor(() => expect(emit).not.toBeNull());
+
+      fireEvent.click(screen.getByRole("switch", { name: "Auth bridge" }));
+      await waitFor(() => expect(setAuthBridgeEnabled).toHaveBeenCalledWith("p1", true));
+
+      // The poller binds a port while the command is still in flight.
+      emit!({ project_id: "p1", status: BRIDGING });
+      expect(await screen.findByText("Bridging 1 port")).toBeInTheDocument();
+    }
+
+    it("keeps the newer state when the command settles with the older one", async () => {
+      const toggle = deferToggle();
+      await startToggleThenPush();
+
+      // …and only now returns the snapshot it took *before* that port existed.
+      toggle.settle({ enabled: true, active_ports: [], conflicts: [] });
+
+      await waitFor(() =>
+        expect(screen.getByRole("switch", { name: "Auth bridge" })).not.toBeDisabled(),
+      );
+      expect(screen.getByText("Bridging 1 port")).toBeInTheDocument();
+      expect(screen.getByText("127.0.0.1:54545")).toBeInTheDocument();
+      expect(screen.queryByText("Watching")).not.toBeInTheDocument();
+    });
+
+    it("does not let the rollback undo a status pushed while it was failing", async () => {
+      // The command failed, so the error belongs on screen — but the bridge
+      // demonstrably came up, and reverting the switch to off would contradict
+      // the port listed right beside it.
+      const toggle = deferToggle();
+      await startToggleThenPush();
+
+      toggle.fail("bridge probe timed out");
+
+      expect(await screen.findByText(/probe timed out/)).toBeInTheDocument();
+      expect(screen.getByText("Bridging 1 port")).toBeInTheDocument();
+      expect(screen.getByRole("switch", { name: "Auth bridge" })).toBeChecked();
+    });
+  });
+
   it("puts the switch back if the command rejects", async () => {
     setAuthBridgeEnabled.mockRejectedValue("Project p1 not found");
     render(<AuthBridgeRow project={project} />);