feat(settings): data-safe editors, deep-linked search, Data/About/Cost pages

- EditorModal loads once per path (a parent re-render no longer reloads the
  file over the user's typing), refuses Save after a failed load, opens a
  truncated (>256 KB) file read-only, and asks before overwriting a file
  that changed on disk or could not be re-read.
- Settings/Hooks editors unset only keys from the snapshot taken at Edit,
  warn when the file changed underneath, keep a renamed key's value, and
  refuse a new key named like a redacted one (env) or a read-only hook
  event, which used to replace the secret/hooks.
- Project scope shows its resolved folder and is disabled inside the
  plugin cache. Account-profile, pricing-row and pet deletes confirm;
  two-click actions disarm after 3 s; unsaved drafts ask before closing.
- Search indexes every Claude Code / Codex sub-tab, opens it via ?tab= and
  scrolls to + highlights the row; the active config tab is in the URL.
- General splits into General / Data / About; Pricing moves to a Cost
  group with one shared load; config tabs group as Content / Extensions /
  Config with arrow-key roving; Promise.allSettled per tab.
- Data: browser-preferences export/import (allowlisted keys), per-section
  reset, housekeeping dry-run first, clear-all behind a typed phrase.
  Server: purge days must be a whole number >= 1 (INVALID_PURGE_DAYS) and
  dry_run returns exactly what the real run would delete.
- Alerts can be edited; webhooks/alerts/remote-source failures toast;
  copies go through copyText; modals get dialog roles and useDialog.
- Sagi: Ctrl/Cmd+B only when shown and not typing, default spot clear of
  row controls, arrow keys move it, reduced motion honoured; the dead
  /run launch link goes to the workspace.

client/src/components/__tests__/UpdateNotifier.test.tsx

@@ -221,3 +221,28 @@ describe("UpdateNotifier — Update now", () => {
     expect(screen.queryByText(i18n.t("updates:restarting"))).not.toBeInTheDocument();
   });
 });
+
+describe("UpdateNotifier — closing vs skipping", () => {
+  it("Escape only closes for now; Skip this version is the persistent dismiss", async () => {
+    const { unmount } = render(<UpdateNotifier />);
+    await screen.findByText(i18n.t("updates:title"));
+    await userEvent.keyboard("{Escape}");
+    await waitFor(() =>
+      expect(screen.queryByText(i18n.t("updates:title"))).not.toBeInTheDocument()
+    );
+    expect(localStorage.getItem("agent-monitor-update-dismissed-sha")).toBeNull();
+    unmount();
+
+    render(<UpdateNotifier />);
+    await userEvent.click(await screen.findByText(i18n.t("updates:skipVersion")));
+    expect(localStorage.getItem("agent-monitor-update-dismissed-sha")).toBe("bbb");
+  });
+
+  it("ignores Escape while an update is applying", async () => {
+    applyMock.mockReturnValue(new Promise(() => {}));
+    render(<UpdateNotifier />);
+    await userEvent.click(await screen.findByText(i18n.t("updates:updateNow")));
+    await userEvent.keyboard("{Escape}");
+    expect(screen.getByText(i18n.t("updates:title"))).toBeInTheDocument();
+  });
+});