diffr web: search, onboarding, summaries, agent tools, and a build that fits CI

[milanb17]

Summary

Add file/text search, onboarding, summaries, agent tools, caching, and a usable mobile interface to diffr web. Stacks on #1018; merge #1018 first.

Mobile header → animated file-tree sheet → file navigation
Touch scrolling + native selection → Monaco structural folding
GitHub sources → workers → cached diffs → optional summaries

• ⌘P opens files and ⌘F searches diffed text. Onboarding supports optional GitHub and summarizer credentials. Config settings expose their reference.
• Summaries run after the initial diff and fold long bodies behind pseudocode. WebMCP tools expose comparison data, lenses, and optional fold plugins. Results are cached in IndexedDB.
• Mobile uses a compact header, desktop-style tree with change indicators/counts, native vertical inertia and text copying, and horizontal swipes with momentum for unwrapped code. Structural fold controls remain available, including touch targets and pinch handling. Sheet/menu animations respect reduced motion; Safari keeps the file sheet open through its exit animation. Long summaries pan without truncation, shared scrollbars remain above diffs, and phone landscape keeps mobile controls.
• Scroll updates only reposition visible fold controls instead of rebuilding decorations for every function. Native scrolling avoids redundant position writes during viewport height changes, and Safari focus cannot shift the virtual content wrapper sideways.
• Worker failures now terminate the pool, reject pending calls, and ignore late responses. Streaming updates preserve open display/theme menus; native popover toggles prevent a dismissal from immediately reopening the menu.

Evidence

• Final mobile stress runs: Chromium 241 seconds at 4× CPU throttling and WebKit 244 seconds, across eight portrait/landscape sizes. Combined: 188 menu, 188 sheet, 188 fold, 282 swipe, and 94 copy-handler checks; zero page errors. WebKit gestures are synthetic because Playwright lacks native touch drag; its timing includes long frames during repeated resize/fold work.

• A separate 240-second WebKit steady-scroll run traversed 359,734 pixels through 300 functions: 18 ms p95, 28 ms maximum frame intervals, zero intervals above 50 ms, no page errors, and a passing function-fold check afterward. This drives the scroller programmatically, not native iOS touch inertia.

• A 300-function scroll probe at 4× CPU throttling reduced p95 fold-control update cost from 77.9 ms to 1.0 ms. Repeated height changes during swipes reduced redundant native scroll-position writes from 19 to zero.

• Before: horizontal swipes did not move long code lines with wrapping off. After: the same mobile Chromium swipe moves code 313px; vertical scrolling, structural fold taps, and copying still pass.

• Mobile Chromium and WebKit end-to-end checks cover real GitHub data and WASM diffs, file tree/search/status filters/navigation, structural folding, copy, animations, and reduced motion. Responsive layout checked from 320px to desktop width.

• The preceding revision was checked in the native iPhone simulator for file navigation, fold taps, and horizontal/vertical scrolling. The latest mobile polish could not be rechecked natively because the Mac was locked. Native iOS pinch remains unverified: the available automation did not deliver a reliable two-finger gesture.

• Failure-injection check verifies pending/new calls reject, workers terminate, late responses are ignored, and counters reset.

• Rebuilt WASM, seven browser-engine Rust tests, 15 Whiteboard/diffr integration tests, browser typecheck/build, and the full repository pnpm run ci suite pass locally. Fresh GitHub checks validate this restacked head; see the checks tab for current status.

Merge Danger

Door: two-way; code and deployments can be reverted.

Blast Radius: browser UI and worker lifecycle, plus native summarizer/plugin support. Agent plugins execute JavaScript in a worker that can hold the summarizer key, so only trusted plugins should be installed. Mobile viewport behavior and touch handling differ from desktop; native iOS pinch needs manual validation. No production deployment occurs from this PR's preview workflow.