dashboard: clickable file-path previews

agents constantly emit pointer strings to /agents/<n>/state/foo.md
since broker bodies cap at 1 KiB. now those tokens linkify in the
message flow, question bodies, answer text, and operator inbox;
clicking expands an inline <details> that lazy-fetches via the
new /api/state-file?path=... endpoint.

endpoint allow-list: per-agent state dirs + shared docs, both
in their container-mount form (/agents/<n>/state, /shared) and
host form (/var/lib/hyperhive/...). 1 MiB read cap; canonicalises
before the prefix check so `..` / symlinks can't escape.

legacy bare `/state/...` is deliberately not matched — ambiguous
from the host's perspective (we'd need to know which agent the
message references to translate). agents should use the qualified
form going forward.

TODO.md

@@ -25,7 +25,13 @@
      and peer (agent-to-agent) threads, with filter chips (all /
      @operator / @peer / per-participant) and an 0V3RR1D3 button on
      peer rows so the operator can answer when an agent is stuck. -->
-- **Clickable file paths in message bodies**: agents drop pointer strings like `/agents/<name>/state/foo.md` constantly (it's the whole 1 KiB-cap escape hatch). Right now they're plain text — operator has to copy-paste into a terminal to peek. Detect path-shaped tokens (start with `/agents/`, `/shared/`, `/state/`, or absolute `/var/lib/hyperhive/...`) in rendered message bodies + question text + answer text + helper-event payloads, render as clickable links that hit a new `/api/state-file?path=…` dashboard endpoint. Endpoint serves the file as text (with a strict allow-list — only paths under `/var/lib/hyperhive/agents/*/state/`, `/var/lib/hyperhive/shared/`, never anything else), syntax-highlighting where it makes sense, falling back to download for binaries. Reuses the existing `<details>` collapse pattern so inline preview doesn't blow up the message-flow stream.
+<!-- Landed: PATH_RE-detected pointer strings in message + question +
+     answer + inbox bodies linkify to inline <details> previews
+     fetched from /api/state-file. Allow-list: `/agents/<n>/state/...`
+     + `/var/lib/hyperhive/agents/<n>/state/...` + `/shared/...` +
+     `/var/lib/hyperhive/shared/...`. Legacy bare `/state/...` is
+     intentionally NOT matched (ambiguous from host's perspective);
+     prefer `/agents/<n>/state/...` in agent outputs. -->
 - **UI for pending reminders**: show pending/queued reminders in dashboard, allow operator to view/debug/cancel
 - Per-agent reminder status (pending, delivered)
 - Reminder query interface for debugging