feat(artifacts): add safe reopenable previews

[celeroncoder]

Summary

• add durable artifact cards and a session artifact list that reopen the selected artifact in a resizable right-side inspector
• serve scoped artifact content and downloads after validating artifact, session, and agent identity
• render HTML in an opaque sandbox with inline scripts/styles, a deny-by-default CSP, and no application-origin, network, navigation, forms, or popup privileges
• provide source preview, copy, and raw-file download fallback for non-HTML artifacts

Validation

• pnpm eval
• pnpm typecheck
• pnpm lint
• pnpm oxlint
• pnpm build
• React Doctor (no findings)
• live UI verification: durable reopen/close, semantic keyboard-resizable separator, right-side inspector layout, source fallback, and HTML sandbox/CSP behavior
• vision review of the final inspector layout

Known Limits

• HTML runs with inline scripts only; external resources, network connections, forms, popups, and navigation are blocked.
• Non-HTML artifacts use a source preview and raw-file download rather than a native format renderer.

Closes #6