feat: add links organizer UI and assistant promotion

[richardfogaca]

Linked issue

Refs #1716
Related #1766

Summary

• Adds the production Links organizer UI for session links, Branch modal links, pinned session links, BranchCard pinned links, assistant pinned links, and chat upload attachment cards.
• Adds safe uploaded-link preview/download support via /link-content/:linkId for images, Markdown/text, and downloadable documents.
• Adds assistant link promotion/removal so session/branch links can be copied into the board's primary assistant links without moving the source link.
• Polishes link hover, pinned-chip, and row action behavior so rows remain clickable while pin/promote controls stay separate.

Why / context

This takes the accepted explore-links-organizer-ui visual exploration and hardens it into real service-backed behavior on top of the links foundation branch.

The goal is to keep the visual UX that tested well while removing exploration-only fixtures, local paths, fake pin state, and query-mode demos. Links remain scoped as session-owned or branch-owned records; assistant links are represented as pinned branch-owned links on the board's primary assistant branch.

Implementation notes

• This PR is stacked on issue-90-links-foundation / feat: add links foundation #1689.
• Session and branch link lists use persisted links service records plus existing branch issue/PR references.
• Pinned session links render below the session controls; branch-owned pinned links render on BranchCard; assistant pinned links render in the assistant side panel.
• Assistant promotion copies a source link target into the primary assistant branch and pins the assistant copy. It is idempotent by target_key and does not move/delete the source link.
• /link-content/:linkId is bearer-authenticated, loads through links.get, serves uploaded file-backed records only, rejects symlinks/out-of-upload-root paths, and enforces MIME/size constraints.
• Chat attachment cards are derived from uploaded session links with source_message_id; parsed URLs are not duplicated as cards.
• No schema migration is added in this PR.

Validation / test plan

• pnpm exec biome check <focused changed files>
• git diff --check
• Docker daemon tests: link-promotion.test.ts + link-content.test.ts — 10 tests passed
• Docker UI tests: linkPromotion.test.ts, linkDisplay.test.ts, SessionLinksControl.test.tsx, BoardAssistantPanel.test.tsx, SessionPanel.test.tsx — 21 tests passed
• Live env smoke on http://localhost:5053 / http://localhost:3053/health
• Live promotion validation: session link promote/remove, branch Links tab promote/remove, KB/ref promotion, uploaded image promotion/content route, assistant panel realtime update, source link retention after removal

Host Vitest could not run in this isolated worktree because local deps are incomplete (vitest/config, vitest, @vitejs/plugin-react unresolved); the same focused suites passed inside the branch Docker environment.

Screenshots / demos

Screenshots captured from the live branch environment:

Session quick links popover

Manage links drawer

Branch Links tab

Session pinned links strip

Assistant pinned links

BranchCard pinned links

Chat attachment cards

Assistant promotion state

Risks / rollout / rollback

• The UI adds new link-management surfaces but uses existing service events and service-backed records.
• Uploaded content serving is intentionally narrow: uploaded file-backed links only, no arbitrary repo-file serving.
• BranchCard currently fetches pinned branch links per card; acceptable for this pass, but batching may be worth considering if large boards become slow.
• Rollback is reverting this PR; no migration or persistent schema change is introduced here.

Out of scope / follow-ups

• Slack attachment ingestion into agent context (Gateway: let agents view images/files uploaded in Slack threads #1704 / Gateway: add secure text/log file ingestion for Slack attachments #1718 / Gateway: support rich document and media attachments beyond images/text #1719).
• Agent-context/system-prompt injection for pinned links/KB (preset-io/agor-cloud#112).
• OCR/PDF/Office rich previews and extraction.
• Historical backfill for existing session links/uploads.
• Batched BranchCard pinned-link fetching if board-scale performance requires it.

[richardfogaca]

Architecture follow-up is tracked internally in preset-io/agor-cloud#146. This UI stack should be reworked against that lifecycle so links use board/session scoped fetches, normalized store indexes, and centralized realtime reducers instead of component-local fetch/listener state.