feat(sidebar): new, rename and delete, without leaving the app

[evangress]

Movement II branch 12 of ROADMAP.md. Stacked on #40 — the diff here is the single
sidebar commit; GitHub will retarget this to main when #40 merges.

Toril could open and save a note but not organize one: renaming meant going to the file
manager and coming back. This adds new note, new folder, rename and delete to the
files pane, and in doing so gives two already-built, already-tested pieces of Rust their
first caller — trashbin shipped in v1.0.0 with no UI at all, and snapshots::rekey was
written for exactly this rename.

Where the rules live

crates/fileops, not the command layer, because they are not obvious and they are mostly
Windows: reserved device names that appear to work and then behave like hardware, names
ending in a dot or space that Windows silently strips (so the file that appears is not the
one we returned a path for), and a case-only rename that a case-insensitive filesystem
reports as a collision with the file itself. Every operation refuses to clobber and
requires its target inside the open folder.

Containment is checked with canonicalize and never used to build a result. On Windows
that returns \?\C:\…, which does I/O fine and matches nothing else in the app — not the
sidebar tree, not an open tab, not a note's history key — so it would quietly split one
note into two identities. Pinned by a test.

Two judgement calls

Delete offers Undo instead of asking first. The file moves into .trash/, so the act
is reversible by construction and a confirmation would be friction in front of it. The one
thing trash cannot bring back is an unsaved buffer, and that is the one case that stops and
asks.

The menu is a DOM menu, not a native one. A native popup cannot be driven by the
headless gates, and native dialogs are the one thing documented to hang the app on the Linux
dev box.

§3 surface: rename

The watcher reports a rename as delete-then-create, which is the shape removedOnDisk
exists to catch — left alone, an open tab decides its file vanished and offers to recreate
it, resurrecting the old note beside its new name. doRenameEntry re-points every
affected tab (including tabs under a renamed folder), bumps the removal epoch for each old
path so an in-flight reconcile cannot apply a stale missing verdict, and clears
removedOnDisk — all in one synchronous block. base is deliberately not reset: a rename
changes no bytes, so the merge base is still exactly right.

Gates

• cargo test -p fileops — the Windows name rules and the near-misses that must still be
  accepted (console.md, com10.md), containment against a traversal dressed up as a
  subdirectory, no-clobber on every create/rename while a case-only rename still succeeds,
  and the caller's-spelling regression above.
• tests/sidebar.test.ts — the menu offers only what is wired, a rejected name keeps the
  field open with the message, blur cancels rather than commits, and a background refresh
  cannot delete what is being typed.
• tests/contextmenu.test.ts — one menu at a time, dismissal actually removes its document
  listeners, and the menu closes before its handler runs.

Full run on this branch: 565 TS tests, 130 crate tests, cargo fmt --check and
cargo clippy --workspace --all-targets clean.

Still open from this branch

Drag-to-move in the tree, multi-select, and a trash browser — list_trash has a command and
an ipc.ts wrapper but no UI, so Undo reaches only the most recent delete. On-device
verification is §E of docs/ON-DEVICE-VERIFICATION.md.

🤖 Generated with Claude Code