feat(dashboard): brain:// links open a live decrypted document pane

[futurepaul]

Stack: #576 → #577 → #578 → #579. Browser side of the viewer.

Phase 2c of the brain:// live viewer plan. Clicking a brain:// link in
an agent reply opens the preview pane in live document mode; the
browser decrypts and renders Brain data client-side and follows
updates without a reload.

• chat-preview-urls: brain:// detection (markdown links and prose);
  brain-doc-url parsing for the rename-proof
  brain://// shape
• hosted-web-chat: preview items become a site | brain-doc union;
  brain:// markdown links click through to the pane (react-markdown
  urlTransform admits the brain scheme on top of the safe defaults);
  desktop panel and mobile drawer render BrainDocPanel
• brain-viewer-crypto: the browser mirror of the Rust crypto —
  ephemeral nostr keypair (tab memory only), NIP-98 auth headers,
  NIP-44 unwrap of the wrapped Folder Key, AES-256-GCM opening of
  finite-folder-object-v1 envelopes against the canonical-JSON AAD,
  and client-side record replay into a path index (ADR-0005 pattern)
• BrainDocPanel: mint session via /api/brain/viewer-sessions (hosted
  device signs as the signed-in principal), poll for the agent's wrap,
  unwrap, encrypted-read, decrypt, render markdown-only (the renderer
  is the sanitizer), fetch-streamed SSE (EventSource cannot carry the
  NIP-98 header) with delta fetches and silent TTL renew
• honest states: waiting for your agent, session expired, revoked,
  folder too large, decrypt/config failures
• browser suite: fake Brain server (CORS-decorated like the real
  middleware, Rust-format envelopes, NIP-44 wraps, SSE) proves click
  → waiting → wrap → decrypted render → no durable key storage → SSE
  edit → re-render without reload → delta fetch observed
• finite-nostr: fixed-vector test pinning the nostr-tools ↔ Rust
  NIP-44 boundary the wrap unwrap depends on

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}