dashboard: drop the path-link and side-panel code the flow page was the only user of

appendLinkified had one caller, the flow page, and it pulled in the
path-link and file-preview chain, the side-panel singleton, the marked
and DOMPurify wiring and the css only they used. The docs stop
describing the dashboard side panel and the client reading file_refs.

docs/web-ui/README.md

@@ -84,7 +84,7 @@ JS renders — no full-page reloads.
   side panel, slash commands, and per-agent endpoints.
 - **[Shape (shared by both)](shape.md)** — the SPA skeleton, SSE
   multiplexing, terminal pane, listener bind, per-agent relative
-  paths, `data-async` form pattern, side panel, atomic repaint.
+  paths, `data-async` form pattern, atomic repaint.
 - **[CSS theme variables](css-vars.md)** — the Catppuccin Mocha custom
   properties declared once in `base.css` and the rule that per-page
   stylesheets reference (never redeclare) them.

docs/web-ui/dashboard.md

@@ -564,19 +564,14 @@ below — some endpoints aren't in it yet.
   and the host form. Canonicalises + verifies the path stays
   inside the allow-list, refuses anything but a regular file,
   refuses `/agents/<n>/claude` / `config` subtrees, truncates
-  bodies at 1 MiB. Selection-time backing for the inline path-link
-  preview.
+  bodies at 1 MiB. No dashboard page calls it since the flow page
+  stopped existing.
 
-  <!-- vale write-good.Passive = NO -->
-  The broker forwarder detects which tokens *are* path links
-  **server-side at broker-message ingest**, not client-side:
-  it calls `scan_validated_paths(body)` —
+  The broker forwarder still detects path tokens **server-side at
+  broker-message ingest**: it calls `scan_validated_paths(body)` —
   same allow-list helper the read endpoint uses — and attaches
   the verified file tokens to the event as `file_refs: Vec<String>`.
-  The client trusts that list and linkifies only those tokens,
-  so directories, missing files, and forbidden subtrees never
-  become anchors. No probe endpoint, no client-side regex
-  heuristics.
+  No dashboard page reads that list either.
 - `GET /api/reminders` — list pending reminders for the
   dashboard's queued-reminders panel.
 - `GET /api/stats-hive?window=<1h|4h|24h|3d|7d|30d|all>` — hive-wide

docs/web-ui/shape.md

@@ -243,9 +243,7 @@ values rather than per-row caches.
 **`<details>` open-state preservation:** any collapsible element
 tagged with `data-restore-key="<stable-key>"` survives the
 refresh. `snapshotOpenDetails()` walks managed sections before
-render, `restoreOpenDetails()` re-applies after. Long-content
-drill-ins (file previews, diffs) now open in the
-**side panel** (see below) rather than expanding inline. The
+render, `restoreOpenDetails()` re-applies after. The
 dashboard's own answered-questions history list was the only
 `<details data-restore-key>` consumer and is gone
 — `snapshotOpenDetails()` / `restoreOpenDetails()` currently have
@@ -254,35 +252,6 @@ that needs it rather than ripped out along with their one caller.
 
 <!-- vale write-good.Passive = YES -->
 
-**Side panel (dashboard):** long content opens in a drawer that
-swipes in from the right — a singleton `#side-panel` with a
-titled header, a close button, and a scrollable body. Closes on
-the button, selecting the backdrop, or `Escape`. `Panel.open(title,
-node)` swaps the body; the JS builder for file previews
-renders into it. **The
-drawer width is drag-to-resize**: a thin 6px hit-strip on
-the left edge captures pointer events, resizes the drawer in
-real-time (pointer capture keeps dragging even if the cursor
-outpaces the handle), and persists the chosen width to
-`localStorage` (key `hyperhive:side-panel-width`) so it
-survives page reload. CSS clamps the width between `min-width: 320px`
-and `max-width: 96vw`; the viewport-resize handler re-clamps
-persisted values after a window shrink. File
-previews are type-aware:
-
-- **Markdown** (`.md` / `.markdown`) — a `rendered` / `plain`
-  tabbed view: `rendered` (default) is the vendored `marked`
-  bundle (`GET /static/marked.js`), `plain` is the raw source.
-- **SVG** (`.svg`) — a `rendered` / `source` tabbed view;
-  `rendered` shows the image via an `<img>` `data:` URI (the
-  browser's secure static mode, so an untrusted SVG can't run
-  scripts), `source` shows the raw markup.
-- **Raster images** (`.png` / `.jpg` / `.gif` / `.webp` /
-  `.bmp` / `.ico` / `.avif`) — render as an `<img>` pointed at
-  `/api/state-file`, which serves them as binary with their
-  real content-type (text files stay UTF-8-lossy `text/plain`).
-- **Everything else** — raw text in a `<pre>`.
-
 ## Listener bind
 
 Both bind their TCP listener with `SO_REUSEADDR` via