feat(canvas): show local files as material cards

[SaneSanders]

Summary

• drop local files onto the canvas (or paste an image with Cmd/Ctrl+V) to get material cards: images render inline, other files show their icon and size; cards move/resize with grid snapping and can be opened, revealed in the file manager, or removed
• materials persist in the user data folder and survive reloads; the state file is written strictly before blob payloads are collected
• source files are watched: a moved or deleted file marks the card, with relink and accept-move flows to recover it
• every materials IPC channel validates the trusted main renderer and registers through the readiness gate like the other service groups; the material protocol handler is registered before the first navigation so previews load on a cold start

This is the first PR of a series that builds canvas materials further (remarks and versions, handoffs to agents, text and media bodies, results acceptance). Each next part comes as its own PR after this one lands.

Test plan

• npm test (1758 pass, 0 fail), npm run typecheck, npm run build, node scripts/audit-secrets.mjs
• live on macOS with the production build: drop a png and a markdown file onto the canvas; image preview renders, file card shows icon and size; plain V does not paste, Cmd/Ctrl+V pastes; reload restores the cards and their previews
• screenshots: narrow (1120×720) and wide (1720×1080) windows, at UI scale 1.0 and 1.4

	narrow	wide
UI scale 1.0
UI scale 1.4