feat(config): create a new project's memory file from Settings

The Memory tab could only show this machine's user memory and the
dashboard's own project file. Setting up a project you had not run
through the dashboard meant opening a terminal — `PUT /file`'s
"project" scope always resolves against the server's cwd, on purpose.

Add one narrow route per tool that writes into the directory you name:
CLAUDE.md for Claude Code, AGENTS.md for Codex, both through the same
`project-memory.js`. Being the only write path that honours a
caller-supplied directory, it pays for that:

  - the directory must be absolute and already exist — nothing is
    created for you;
  - the filename comes from the route, never from the body;
  - an existing file, symlink included, is a 409 — this can only
    create, never overwrite;
  - it sits behind the loopback-Origin guard /api/run uses, so a page
    in the user's browser cannot plant agent instructions in a project
    directory. That guard moves to lib/same-origin.js to be shared.

The modal takes the dashboard's known project dirs as suggestions on a
free-text input rather than a closed list: a project it has never seen
is exactly the case this exists for.

Mutation-checked: dropping the origin guard, and swapping lstat for
stat, each fail a test.

client/src/lib/api.ts

@@ -1470,6 +1470,22 @@ export const api = {
         method: "PUT",
         body: JSON.stringify(args),
       }),
+    /**
+     * POST /api/cc-config/project-memory - create `CLAUDE.md` in a project the
+     * dashboard has never run in.
+     *
+     * Unlike {@link api.ccConfig.write}, whose "project" scope always means the
+     * dashboard server's own directory, this one writes into the directory you
+     * name. It only ever creates: an existing CLAUDE.md comes back as a 409.
+     *
+     * @param args `dir` (absolute, must already exist) and the file's `content`.
+     * @returns {@link ProjectMemoryResult} — the written path and its size.
+     */
+    createProjectMemory: (args: { dir: string; content: string }) =>
+      request<ProjectMemoryResult>("/cc-config/project-memory", {
+        method: "POST",
+        body: JSON.stringify(args),
+      }),
     /**
      * DELETE /api/cc-config/file - remove a config artifact (also backed up).
      *
@@ -1702,6 +1718,19 @@ export const api = {
         method: "PUT",
         body: JSON.stringify(args),
       }),
+    /**
+     * POST /api/codex-config/project-memory - create `AGENTS.md` in a project
+     * the dashboard has never run in. The Codex twin of
+     * {@link api.ccConfig.createProjectMemory}, same create-only rule.
+     *
+     * @param args `dir` (absolute, must already exist) and the file's `content`.
+     * @returns {@link ProjectMemoryResult} — the written path and its size.
+     */
+    createProjectMemory: (args: { dir: string; content: string }) =>
+      request<ProjectMemoryResult>("/codex-config/project-memory", {
+        method: "POST",
+        body: JSON.stringify(args),
+      }),
     /**
      * DELETE /api/codex-config/file - remove a config artifact (also backed up).
      *
@@ -2956,6 +2985,17 @@ export interface CodexMutationResult {
   backup?: { [key: string]: unknown } | null;
 }
 
+/**
+ * Result of creating a project's memory file (CLAUDE.md / AGENTS.md) via
+ * POST /api/{cc,codex}-config/project-memory. `file` is the resolved path —
+ * worth showing back, since the server realpaths the directory it was given.
+ */
+export interface ProjectMemoryResult {
+  file: string;
+  size: number;
+  created: true;
+}
+
 /** One timestamped backup of a config artifact, from GET /api/codex-config/backups. */
 export interface CodexBackup {
   type: string;