fix review findings from lui extension replacement

[RCmerci]

Summary

Address the 5 Devin Review findings on #31 (e8751e7), applied on top of the merged content on devin/1790580543-composer-assets.

• decode_picked: String.sub "" 1 0 on extensionless filenames raised and silently discarded the pick → derive file_type through the existing file_extension helper ("bin" fallback) moved above the decoder.
• stage_copy: really_input_string read the entire pick into one string → stream copy in 64 KiB chunks; on failure the partial temp file is removed.
• staged_completion: echoed the armed request token whenever pending <> [], so a newly armed pick request was completed before its pick could land → track spent_requests (armed tokens that produced an accepted pick) and only echo completion for those.
• clear_graph_surface: media_preview survived graph switches, leaving the prior graph's QuickLook preview mounted → reset it with the rest of the graph surface.
• journal_media_view.is_image_type: tif/avif were dropped versus the retired extension's isImage (JournalMedia.swift) → restored; file_image's ImageIO thumbnail path decodes both.

dune build / dune runtest green except the pre-existing V.progress boundary failure (identical on main).

Link to Devin session: https://app.devin.ai/sessions/55c3d31f1c6d4ee4beda2f832725d7b7
Open in Devin Desktop: https://app.devin.ai/desktop/session/55c3d31f1c6d4ee4beda2f832725d7b7?variant=devin
Requested by: @RCmerci

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring