P5 Den: build configuration editor

[Shooksie]

Context\n\nCodex product-owner sweep 2026-04-13 15:32 CST identified the next non-overlapping P5 Den roadmap slice. Opus sweeps #367-#369 are correctly focused on Enterprise Tier 2 for ao-cloud/ao-v2, while Den remains a parallel track. Memory says Den P1-P5 are complete, so the next desktop layer is a configuration editor.\n\nLive AO queue enqueue from the Codex sandbox failed with Operation not permitted (os error 1), so this issue is the durable fallback dispatch artifact.\n\n## Requirement\n\nImplement /Users/samishukri/ao-product/requirements/2026-04-13-den-configuration-editor.md.\n\n## Acceptance Criteria\n\n- Add a configuration editor surface in Den for the selected project that reads existing .ao/ workflow and agent configuration files.\n- Preserve comments and formatting when possible; if the existing stack cannot preserve comments, document the limitation and avoid rewriting unrelated files.\n- Support basic edits for agents, workflows, schedules, environment variable references, and project metadata that already exists in the repo config model.\n- Validate edits before saving and show actionable errors instead of writing invalid YAML.\n- Save changes through the existing Tauri/backend file access pattern with explicit confirmation for destructive or broad rewrites.\n- Include focused tests or manual verification notes for load, validation failure, successful save, and reload behavior.\n- Follow ao-desktop gotchas: use standard-workflow, use Claude tooling, and do NOT edit /Users/samishukri/brain/repos/ao-desktop/VISION.md.\n- Do not commit secrets, .env, .ao/sync.json, credentials, or user-specific absolute paths beyond documented examples.\n\n## Non-goals\n\n- Do not invent a new workflow YAML schema.\n- Do not add remote daemon configuration yet; that is a later Den layer.\n