feat(desktop): preview documents in the workspace and images in chat

Documents the agent writes open in the workspace panel instead of another
application, and local images the agent mentions show up in the conversation.

Workspace preview
- PDF (pdf.js with its own layout and text layer), Word (docx-preview inside a
  scripts-disabled sandboxed iframe) and Excel (SheetJS; .xlsx, .xlsm, .xls) open
  in the side panel with zoom and fit, per-file scroll/zoom/sheet memory, and a
  refresh when the agent rewrites the file. The engines load lazily.
- Bytes come from a new GET /api/sessions/:id/workspace/raw route, with an
  extension allowlist, size caps, the workspace boundary and canonical-path
  checks. The file endpoint returns metadata and a version for documents. The
  client fetches with the bearer credential, so it works in Electron, LAN H5 and
  remote access alike.
- Chat links, output cards and the change card open pdf/docx/xlsx in the
  workspace; documents outside the workdir still go to the system application.
- Image viewer with fit, zoom and pan, and "open in system app".

Chat images
- Markdown images outside the workdir, at ~/, C:\ and file:// paths render, open
  in the viewer, and offer "open original" (pictures only).
- Images returned by tools such as Read appear as thumbnails under the call.

Hardening found in review
- previewFsUrl escapes each path segment; a double-escaped %2e%2e used to leave
  /preview-fs/<session>/.
- The CORS, API timing and remote-access header decorators set headers in place.
  Rebuilding the response buffered whole files in memory and dropped
  Content-Length.
- The engine owns the pdf.js worker, so closing one document no longer fails the
  next open.
- Office archives are inflated in steps to check their real sizes, not the sizes
  they declare.
- A viewer that fails to load stays in its panel instead of taking the window down.

Adds pdfjs-dist, docx-preview, xlsx (SheetJS 0.20.3 tarball) and fflate as
renderer dev dependencies; Vite bundles them.

Refs #1397

docs/desktop/workspace.md

@@ -35,6 +35,19 @@ order: 2
 
 任何文件都可以右键复制路径，或者点「添加到聊天」把它作为上下文塞回输入框。
 
+### 预览 PDF、Word、Excel 和图片
+
+Claude 生成的报告、论文、数据表不必再切到别的软件去看。在文件标签里选中它们，或者点对话里指向它们的链接和文件卡片，就会直接在工作区里打开：
+
+- **PDF** — 连续滚动，可以缩放，文字能选中复制。默认适应宽度。
+- **Word（`.docx`）** — 显示文字和基本排版。公式和部分形状不会出现，预览上方会有提示；需要精确排版时，用「用系统程序打开」打开原文件。
+- **Excel（`.xlsx`、`.xlsm`、`.xls`）** — 每个工作表一个标签页，单元格按 Excel 中的显示格式呈现。图表、图片和公式不显示；每张表最多显示前 5000 行、100 列，超出时会说明。
+- **图片** — 适应窗口显示，可以缩放和拖动；按住 `⌘` / `Ctrl` 滚动滚轮或在触控板上捏合来缩放，双击在「适应窗口」和 100% 之间切换。
+
+预览区顶部的「用系统程序打开」会把原文件交给系统默认程序。太大的文件（PDF 超过 100 MB，Word / Excel 超过 30 MB）和已加密的 PDF 不会预览，同样可以用系统程序打开。工作区之外的文档也一样，直接交给系统程序。
+
+Claude 重新写入正在预览的文件时，预览会在原位置刷新；文件恰好写到一半、读不出来时，会继续显示上一次的内容并提示刷新失败。
+
 ## Diff 评审：给某一行留话
 
 ![工作区只读查看 HEAD 提交：变更行与语法高亮 Diff](../images/app/zh-CN/workspace-diff.webp)