feat(sidebar): 文件页与文件变动页 UIUX 重构 + 全局组件抽取

文件页（FileTree/TreePanel）
- Ctrl/Cmd 多选 + Shift 按可见行序连选（Esc/点空白/右键收敛），批量条支持复制路径、批量删除（共享 ConfirmDialog + 顺序 fsRemove）
- Git 变更着色：行名按状态上色 + M/A/D/U 徽标，目录按 dirHasChanges 着色，非仓库静默降级（数据来自共享 git 状态存储）
- 新建文件夹：fs.mkdir 路由 + mkdirWorkspaceEntry + 内联输入行（Enter/Esc/blur/IME 守卫）
- 性能：FileRow/DirRow memo（含反向验证）、搜索 hidden 停车不再卸载树、level 拉取世代守卫 + AbortController、fs.tree truncated 提示、use-dir-watch 入参 memo
- 拖拽上传视觉 token 化（硬编码色清零）；可见性下传后隐藏页签停止轮询
- 右键「打开方式」改为复用 DSH 自带 open-in-app（宿主探测的关联应用 + 文件管理器显示）

文件变动页（changes/diff）
- 36px 头（宿主 SegmentedControl）+ 单一 ChangeRow + SectionHeader 分组 + 吸底提交条单状态行 + 历史独立空态
- 修掉：双份空态、暂存失败 unhandled rejection、手动刷新被丢、仓库切换刷新两次、worktree 清单缺 repoRoot、工作树被自动切走、预览持旧快照、恢复高度未 clamp、session ops 无谓轮询
- DiffPane/DiffTab 共用 use-git-diff；修掉 DiffPane 的 untracked 预览从不渲染

全局组件与宿主接入
- 新增 src/client/ui（IconButton/Chip/SectionHeader/Notice/ConfirmDialog/StatusBadge + 共享 git 状态存储）
- 新增 src/client/open-in-app.ts（宿主 open-in-app 客户端适配），删除自研 open-with 全链路与 open.external 路由
- 客户端 inject 补 remote / remote.session：缺声明时 ctx.get('remote').session 会抛出并把整个面板打成错误条（真实挂载 lane 抓到）
- 词典：+25 键 / -20 openWith* / -noChanges，20 份同步

验证：typecheck / lint / test（126 文件 1322 通过）/ build 全绿；
DSH_CMD='npx -y --package @deepseek-ai/dsh@0.1.7-rc.1 dsh' pnpm test:mount 7/7 通过（含 tab sweep 与 perf lane）

src/client/api.ts

@@ -239,51 +239,6 @@ function gitPayload(scope: SessionScope, worktree: string | undefined, extra: Re
   return scopePayload(scope, { ...(worktree !== undefined && worktree !== '' ? { worktree } : {}), ...extra })
 }
 
-/** One external-open request from the file tree. */
-type OpenExternalPayload =
-  | { action: 'reveal'; path: string }
-  | { action: 'url'; url: string }
-
-/** The host route's success shape. */
-type OpenExternalResult = { started: boolean }
-
-/**
- * Remote VSCode-family URLs must be consumed on the browser/client machine:
- * the DSH host can be a headless remote server with no editor or DISPLAY.
- * Local editor URLs and reveal actions still belong to the host opener.
- */
-function shouldOpenExternalOnClient(payload: OpenExternalPayload): payload is { action: 'url'; url: string } {
-  if (payload.action !== 'url') return false
-  let parsed: URL
-  try {
-    parsed = new URL(payload.url)
-  } catch {
-    return false
-  }
-  return parsed.protocol !== 'http:'
-    && parsed.protocol !== 'https:'
-    && parsed.hostname === 'vscode-remote'
-    && parsed.pathname.startsWith('/ssh-remote+')
-}
-
-/**
- * Dispatch an external-open request to the correct machine. SSH remote-editor
- * URLs stay in the synchronous user-click chain and navigate the client so
- * its registered vscode:// / cursor:// handler can launch. Everything else
- * keeps using the DSH host route.
- */
-function openExternal(payload: OpenExternalPayload): Promise<OpenExternalResult> {
-  if (!shouldOpenExternalOnClient(payload)) {
-    return call<OpenExternalResult>('open.external', payload)
-  }
-  try {
-    window.location.assign(payload.url)
-    return Promise.resolve({ started: true })
-  } catch (error) {
-    return Promise.reject(error)
-  }
-}
-
 /** The sidebar API surface (session scope threaded through every call). */
 export const api = {
   sessionCwd: (scope: SessionScope, signal?: AbortSignal) =>
@@ -307,6 +262,11 @@ export const api = {
    *  row unlinks the link only). The UI confirms before calling this. */
   fsRemove: (scope: SessionScope, path: string) =>
     call<{ path: string }>('fs.remove', scopePayload(scope, { path })),
+  /** Create one directory row inside `path` (single-segment name; the server
+   *  refuses existing destinations, the workspace root, and — while the fence
+   *  is armed — anything resolving outside the workspace). */
+  fsMkdir: (scope: SessionScope, path: string, name: string) =>
+    call<{ path: string }>('fs.mkdir', scopePayload(scope, { path, name })),
   /** Upload one file's raw bytes into `dir` (keeps the folder tree via
    *  `relativePath`); the host streams it under the session workspace. */
   uploadFile: (scope: SessionScope, dir: string, relativePath: string, body: Blob, signal?: AbortSignal) =>
@@ -417,10 +377,6 @@ export const api = {
       patch,
       ...(expectedRevision !== undefined ? { expectedRevision } : {}),
     }),
-  /** External open for the file tree's "open with" menu. Remote SSH editor
-   *  URLs are launched on the browser/client machine; reveal and local URLs
-   *  keep using the host's platform opener. */
-  openExternal,
 }
 
 /** Absolute URL of the media route for one path (images only). */