path linkify: server attaches file_refs at message ingest

drop the /api/state-file/check probe endpoint (which let any
dashboard visitor enumerate filesystem layout by feeding paths)
and the client's optimistic-then-downgrade dance. instead, the
broker forwarder calls scan_validated_paths(body) — same
allow-list helper as the read endpoint — and attaches the
verified file tokens to DashboardEvent::Sent/Delivered as
file_refs: Vec<String>. /dashboard/history backfill does the
same per-row.

client appendLinkified takes a (text, refs) pair, walks
left-to-right linkifying every occurrence of any ref token,
longest-first tie-break. no regex, no probe, no cache, no
queue. when refs is empty/absent the body emits as plain text
(question/answer/reminder rendering — refs for those are a
follow-up).

operator inbox stores file_refs from the sent event so its
renderer gets the same anchors as the message-flow terminal.

docs/web-ui.md

@@ -208,12 +208,19 @@ not ours.
   and the host form. Canonicalises + verifies the path stays
   inside the allow-list, refuses anything but a regular file,
   refuses `/agents/<n>/claude` / `config` subtrees, truncates
-  bodies at 1 MiB. Backs the dashboard's inline path-link
-  preview (PATH_RE detects pointer strings in message bodies,
-  question/answer text, and the operator inbox; clicking
-  expands a `<details>` that lazy-fetches via this endpoint).
-  Trailing-slash matches (i.e. directory paths) are skipped on
-  the client side — only files linkify.
+  bodies at 1 MiB. Click-time backing for the inline path-link
+  preview.
+
+  Detection of which tokens *are* path links is done
+  **server-side at broker-message ingest**, not client-side:
+  the broker forwarder calls `scan_validated_paths(body)` —
+  same allow-list helper the read endpoint uses — and attaches
+  the verified file tokens to the event as `file_refs: Vec<String>`.
+  The client trusts that list and linkifies only those tokens,
+  so directories, missing files, and forbidden subtrees never
+  become anchors. No probe endpoint, no client-side regex
+  heuristics. Historical messages get the same treatment on
+  `/dashboard/history` backfill.
 - `GET /api/reminders` — list pending reminders for the
   dashboard's queued-reminders panel.
 - `POST /cancel-reminder/{id}` — hard-delete a pending reminder.