dashboard: drop the path-link and side-panel code the flow page was the only user of

appendLinkified had one caller, the flow page, and it pulled in the
path-link and file-preview chain, the side-panel singleton, the marked
and DOMPurify wiring and the css only they used. The docs stop
describing the dashboard side panel and the client reading file_refs.

docs/web-ui/dashboard.md

@@ -564,19 +564,14 @@ below — some endpoints aren't in it yet.
   and the host form. Canonicalises + verifies the path stays
   inside the allow-list, refuses anything but a regular file,
   refuses `/agents/<n>/claude` / `config` subtrees, truncates
-  bodies at 1 MiB. Selection-time backing for the inline path-link
-  preview.
+  bodies at 1 MiB. No dashboard page calls it since the flow page
+  stopped existing.
 
-  <!-- vale write-good.Passive = NO -->
-  The broker forwarder detects which tokens *are* path links
-  **server-side at broker-message ingest**, not client-side:
-  it calls `scan_validated_paths(body)` —
+  The broker forwarder still detects path tokens **server-side at
+  broker-message ingest**: it calls `scan_validated_paths(body)` —
   same allow-list helper the read endpoint uses — and attaches
   the verified file tokens to the event as `file_refs: Vec<String>`.
-  The client trusts that list and linkifies only those tokens,
-  so directories, missing files, and forbidden subtrees never
-  become anchors. No probe endpoint, no client-side regex
-  heuristics.
+  No dashboard page reads that list either.
 - `GET /api/reminders` — list pending reminders for the
   dashboard's queued-reminders panel.
 - `GET /api/stats-hive?window=<1h|4h|24h|3d|7d|30d|all>` — hive-wide