feat(desktop): preview documents in the workspace and images in chat

Documents the agent writes open in the workspace panel instead of another
application, and local images the agent mentions show up in the conversation.

Workspace preview
- PDF (pdf.js with its own layout and text layer), Word (docx-preview inside a
  scripts-disabled sandboxed iframe) and Excel (SheetJS; .xlsx, .xlsm, .xls) open
  in the side panel with zoom and fit, per-file scroll/zoom/sheet memory, and a
  refresh when the agent rewrites the file. The engines load lazily.
- Bytes come from a new GET /api/sessions/:id/workspace/raw route, with an
  extension allowlist, size caps, the workspace boundary and canonical-path
  checks. The file endpoint returns metadata and a version for documents. The
  client fetches with the bearer credential, so it works in Electron, LAN H5 and
  remote access alike.
- Chat links, output cards and the change card open pdf/docx/xlsx in the
  workspace; documents outside the workdir still go to the system application.
- Image viewer with fit, zoom and pan, and "open in system app".

Chat images
- Markdown images outside the workdir, at ~/, C:\ and file:// paths render, open
  in the viewer, and offer "open original" (pictures only).
- Images returned by tools such as Read appear as thumbnails under the call.

Hardening found in review
- previewFsUrl escapes each path segment; a double-escaped %2e%2e used to leave
  /preview-fs/<session>/.
- The CORS, API timing and remote-access header decorators set headers in place.
  Rebuilding the response buffered whole files in memory and dropped
  Content-Length.
- The engine owns the pdf.js worker, so closing one document no longer fails the
  next open.
- Office archives are inflated in steps to check their real sizes, not the sizes
  they declare.
- A viewer that fails to load stays in its panel instead of taking the window down.

Adds pdfjs-dist, docx-preview, xlsx (SheetJS 0.20.3 tarball) and fflate as
renderer dev dependencies; Vite bundles them.

Refs #1397

docs/en/desktop/sessions.md

@@ -27,6 +27,7 @@ Claude doesn't just reply with a paragraph. Several kinds of card appear along t
 - **Thinking blocks** — the reasoning before it acts, labelled **Thinking** while it runs and **Thought** once done. Collapsed by default.
 - **File edits** — shown as an inline diff right in the conversation, so you don't have to look anywhere else.
 - **Claude needs your input** — when it's genuinely unsure it asks, with buttons for the likely answers plus a free-text box.
+- **Images** — a local image a reply references with Markdown image syntax is shown right in the conversation, and it doesn't have to be inside the project: an absolute path, one starting with `~/`, a Windows `C:\...` path or a `file:///...` URL all work (for images under your home directory or the temporary directories). Pictures Claude looked at with a tool such as Read also appear as thumbnails under that tool call, without expanding it. Click any of them to zoom and drag; in the desktop app the viewer has **Open in system app** at the bottom right, which opens the original file. When you use the app from a browser (H5), pictures referenced by path don't load yet; the thumbnails of pictures Claude read with a tool are not affected.
 
 In a long conversation, `⌘F` opens find-in-page and jumps between matches in the current session. `⌘K` is global search across every session you've ever had.
 

docs/en/desktop/workspace.md

@@ -35,6 +35,19 @@ If the folder is not a Git repository, the **Review** entry explains why it is u
 
 Any file can have its path copied, or be pushed back into the composer as context with **Add to chat**.
 
+### Previewing PDFs, Word, Excel, and images
+
+Reports, papers, and spreadsheets Claude produces no longer need another app to read. Select one in a Files tab, or click a link or file card that points at it in the conversation, and it opens right in the workspace:
+
+- **PDF** — scrolls continuously and zooms, with selectable text. It opens fitted to the panel width.
+- **Word (`.docx`)** — shows the text and basic layout. Equations and some shapes do not appear, and a note above the preview says so; when you need the exact layout, use **Open in system app** to open the original.
+- **Excel (`.xlsx`, `.xlsm`, `.xls`)** — one tab per worksheet, with each cell shown as Excel formats it. Charts, images, and formulas are not shown. A sheet shows at most its first 5,000 rows and 100 columns, and says so when it is cut off.
+- **Images** — fitted to the window, with zoom and drag. Hold `⌘` / `Ctrl` and scroll, or pinch on a trackpad, to zoom; double-click to switch between **Fit to window** and 100%.
+
+**Open in system app** at the top of the preview hands the original file to your system's default program. Files that are too large (PDFs over 100 MB, Word or Excel over 30 MB) and password-protected PDFs are not previewed; open them with the system app the same way. So are documents outside the workspace.
+
+When Claude rewrites a file you are previewing, the preview refreshes in place. If the file is caught half-written and cannot be read, the last good version stays on screen with a note that the refresh failed.
+
 ## Diff review: leaving a note on a line
 
 ![A read-only review of the HEAD commit with syntax-highlighted diff lines (Chinese interface)](../../images/app/en/workspace-diff.webp)