feat(serve): add @file autocomplete to the web UI

[innocarpe]

Summary

Implements #7640 — @filename autocomplete for the reasonix serve web UI (previously only slash commands existed; the desktop React app has a full @-menu).

Backend — GET /files?q=<frag>&dir=<rel> (internal/serve/serve.go, behind the same auth middleware chain):

• Workspace-root-bound walk: depth limit 20, 10k-entry cap, skips generated/vendor dirs via fileref.SkipEntry, hidden files skipped unless q starts with .
• Matching (mirrors atMatches.ts semantics): case-insensitive substring of basename (preferred), any path segment, or directory name; directories first, capped at 50; bare @ returns the root listing; dir scopes one level (desktop ListDir parity)
• Traversal/absolute dir → 400; unreadable/non-directory → 200 [] (silent)

Frontend (index.html, self-contained, zero new tooling — reuses slash-menu popover markup + escHtml/el helpers):

• @-token detection mirroring the desktop grammar, 150ms debounce + AbortController + stale-guard, silent close on empty/error
• Keyboard nav (Up/Down/Tab/Enter/Esc), mouse hover/click, insertion with backslash-escaped spaces (escapeRefPath parity) + / descend for folders
• i18n keys added (en + zh); closeAtMenu wired into send/reload/goal-mode-Esc paths

Verification

• go test ./internal/serve/ — 118 pass (7 new /files tests: empty-query listing, substring match, hidden-dot-prefix, dir scoping, all 6 traversal forms → 400, unreadable dir → [], depth-limit boundary)
• go vet / gofmt -l — clean; go build ./cmd/reasonix — OK
• Frontend JS (not covered by Go harness): Node VM harness — 11 token-detection/insertion assertions + 12 async debounce/abort/stale-guard assertions, all pass

Issues

Fixes #7640

Documentation impact

Documentation-impact: none - web UI feature; the serve UI is a self-contained HTML, no docs describe its composer behavior.

Cache impact

Cache-impact: none - internal/serve is not a cache-sensitive path (not listed in scripts/check-cache-impact.sh); no prompt/tool surface touched.
Cache-guard: N/A
System-prompt-review: N/A