Fix HIGH and MEDIUM frontend defects

Files pane
- F16: a drag-out released back inside the app no longer re-imports its own
  staged copy over the container original. An in-flight flag (cleared from the
  drag plugin's `onEvent` channel, with a watchdog) suppresses the drop and the
  "Drop files into …" hint, and an exact staged-path filter is the second line
  of defence — the `path|size|modified` cache could otherwise write a
  minutes-old snapshot over a file an agent had since rewritten.
- F17: a slow upload/rename no longer yanks the user back to the directory the
  operation started in. Every operation captures its target path and re-lists
  only if the user is still there; failures go to the toast host either way.
- The grid keeps keyboard focus. Roving tabindex (one tab stop, not one per
  row) plus focus restore after navigation, rename commit/cancel and Escape.
- Transient failures now surface in `ToastHost` (z-[60], persistent aria-live)
  instead of a `role="alert"` 300 rows down a scroller or behind a modal
  overlay. The inline error is kept only for the listing failure.
- `navigate` is sequenced by generation; "Save to host…" sets `busy`.
- Grid a11y: column headers, a text affordance for folder vs file, a live
  region that is mounted empty and announces completion, Label-in-Name fixed.
- FileViewerModal: the blob URL is released only once its replacement exists;
  the preview is a focusable, named, scrollable region.

Native drop routing
- New `lib/dropTarget.ts`: the hit test now refuses a drop while any
  `[aria-modal="true"]` dialog or `[data-blocks-drop]` overlay is up, and
  checks z-order where the environment can answer it. Shared by FilesTab and
  TerminalView; App's shutdown overlay opts in.

Disk
- A partially failed reclaim says so in words ("… — 2 of 5 failed"), not by hue
  alone.
- The scan/reclaim race is closed: every mutation retires an in-flight scan, so
  a scan can no longer repaint a pre-reclaim report plus a clickable plan of
  objects that are gone. Scan is disabled while working; the status is a live
  region; a failed destructive action keeps its dialog open and reports there.
- The "unknown" layer count gets a screen-reader fallback; `--text-disabled`
  no longer carries live information.

Terminal / OAuth
- After the toast is dismissed, a truncated heuristic guess can no longer fill
  the slot that an exact OSC 8 or relay URL occupied — the detector remembers
  every exact URL and drops any candidate that is a strict prefix of one.
- The prompt is reachable by keyboard: Ctrl+Shift+O jumps to the default
  action, Escape dismisses, focus returns to the terminal, and auto-dismiss
  holds off while focus is inside. It deliberately does not steal focus.
- UrlToast renders through `ui/Button` and `--shadow-overlay`.

Elsewhere
- AuthBridgeRow: a pushed `auth-bridge-changed` status always outranks an older
  awaited toggle result.
- The last two ad-hoc byte formatters route through `lib/formatBytes`.

Contract for the backend agent: `upload_file_to_container` refusing to
overwrite must satisfy `isFileExistsError` in `src/lib/uploadErrors.ts` (marker
`FILE_EXISTS`) and accept an `overwrite` argument; the frontend turns that into
an `ui/Modal` Replace/Skip prompt rather than a raw error string.

Tests: 536 -> 627 passing. `npm run build` and `npx tsc --noEmit` green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src/components/projects/home/config/AuthBridgeRow.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { listen } from "@tauri-apps/api/event";
 import {
   getAuthBridgeStatus,
@@ -77,13 +77,35 @@ export default function AuthBridgeRow({ project }: { project: Project }) {
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
+  /**
+   * Which write to `status` is the newest — the same "is this still mine?"
+   * guard `useDiskUsage` and `useContainerMigration` use around their async
+   * writes, and needed here for a reason that is easy to miss.
+   *
+   * There are two sources of truth for this row and only one of them is
+   * ordered. `set_auth_bridge_enabled` resolves with a status *sampled at the
+   * moment it returned*; the poller's `auth-bridge-changed` event carries one
+   * sampled later. Awaiting the command therefore hands back a value that may
+   * already be historical, and writing it unconditionally is how the row ends
+   * up saying "Watching" while a port is in fact bound — the failure mode the
+   * event subscription exists to prevent, reintroduced one line below it.
+   *
+   * So every write claims a generation and only lands if it still holds it.
+   * A pushed event always claims a fresh one, which is what makes it win over
+   * an older awaited result no matter which order the two arrive in.
+   */
+  const generation = useRef(0);
+
   useEffect(() => {
+    const mine = ++generation.current;
     let cancelled = false;
     setStatus(null);
     setError(null);
     getAuthBridgeStatus(projectId)
       .then((s) => {
-        if (!cancelled) setStatus(s);
+        // The initial fetch races the poller exactly like the toggle does: an
+        // event can land first and describe a bridge this reply predates.
+        if (!cancelled && generation.current === mine) setStatus(s);
       })
       .catch((e) => {
         if (!cancelled) setError(String(e));
@@ -98,6 +120,9 @@ export default function AuthBridgeRow({ project }: { project: Project }) {
     let unlisten: (() => void) | undefined;
     listen<AuthBridgeChangedEvent>(AUTH_BRIDGE_EVENT, (event) => {
       if (event.payload.project_id !== projectId) return;
+      // A pushed status is the most recent observation that exists, so it
+      // claims the newest generation and invalidates anything still in flight.
+      generation.current += 1;
       setStatus(event.payload.status);
     })
       .then((un) => {
@@ -116,13 +141,24 @@ export default function AuthBridgeRow({ project }: { project: Project }) {
       setBusy(true);
       setError(null);
       // Optimistic, so the switch responds even though enabling has to await a
-      // container probe. The command's return value replaces it either way.
+      // container probe. It claims a generation like every other write, so a
+      // pushed event that lands mid-flight supersedes it rather than being
+      // undone by the settle below.
+      const mine = ++generation.current;
       setStatus((s) => (s ? { ...s, enabled: next } : s));
       try {
-        setStatus(await setAuthBridgeEnabled(projectId, next));
+        const settled = await setAuthBridgeEnabled(projectId, next);
+        // Stale by the time it arrived: the poller has already told us
+        // something newer, and `settled` predates it.
+        if (generation.current !== mine) return;
+        setStatus(settled);
       } catch (e) {
-        setStatus((s) => (s ? { ...s, enabled: !next } : s));
+        // The error is reported either way — the command really did fail — but
+        // the rollback must not resurrect the pre-toggle value over a status
+        // the poller pushed while the command was failing.
         setError(String(e));
+        if (generation.current !== mine) return;
+        setStatus((s) => (s ? { ...s, enabled: !next } : s));
       } finally {
         setBusy(false);
       }