feat(config): create a new project's memory file from Settings

The Memory tab could only show this machine's user memory and the
dashboard's own project file. Setting up a project you had not run
through the dashboard meant opening a terminal — `PUT /file`'s
"project" scope always resolves against the server's cwd, on purpose.

Add one narrow route per tool that writes into the directory you name:
CLAUDE.md for Claude Code, AGENTS.md for Codex, both through the same
`project-memory.js`. Being the only write path that honours a
caller-supplied directory, it pays for that:

  - the directory must be absolute and already exist — nothing is
    created for you;
  - the filename comes from the route, never from the body;
  - an existing file, symlink included, is a 409 — this can only
    create, never overwrite;
  - it sits behind the loopback-Origin guard /api/run uses, so a page
    in the user's browser cannot plant agent instructions in a project
    directory. That guard moves to lib/same-origin.js to be shared.

The modal takes the dashboard's known project dirs as suggestions on a
free-text input rather than a closed list: a project it has never seen
is exactly the case this exists for.

Mutation-checked: dropping the origin guard, and swapping lstat for
stat, each fail a test.

client/src/pages/CcConfig.tsx

@@ -105,6 +105,7 @@ import {
 import { ToastNotice, type Toast } from "../components/config/ToastNotice";
 import { MdItemList } from "../components/config/MdItemList";
 import { ScopeBadge } from "../components/config/ScopeBadge";
+import { ProjectMemoryModal } from "../components/config/ProjectMemoryModal";
 import {
   Empty,
   SkeletonRows,
@@ -246,6 +247,7 @@ export function CcConfig() {
   const [toast, setToast] = useState<Toast>(null);
   const [backupsOpen, setBackupsOpen] = useState(false);
   const [profilesOpen, setProfilesOpen] = useState(false);
+  const [projectMemoryOpen, setProjectMemoryOpen] = useState(false);
 
   // Auto-dismiss toasts after 5s
   useEffect(() => {
@@ -453,6 +455,20 @@ export function CcConfig() {
     [fetchAll, t]
   );
 
+  // Create CLAUDE.md in ANOTHER project's directory. Deliberately not part of
+  // `handleSave`: that one writes this machine's user/project layers through
+  // the artifact writer, while this names its own target directory.
+  const handleCreateProjectMemory = useCallback(
+    async (args: { dir: string; content: string }) => {
+      const result = await api.ccConfig.createProjectMemory(args);
+      setProjectMemoryOpen(false);
+      setToast({ kind: "success", message: t("projectMemory.created", { path: result.file }) });
+      void fetchAll();
+      return result.file;
+    },
+    [fetchAll, t]
+  );
+
   const handleDelete = useCallback(async () => {
     if (!confirmDelete) return;
     try {
@@ -527,6 +543,18 @@ export function CcConfig() {
                 {t("edit.newButton")}
               </button>
             )}
+            {/* The memory tab's own "new" is a different thing: the two
+                CLAUDE.md cards below are this machine's user + current-project
+                files, while this creates one in ANOTHER project's directory. */}
+            {tab === "memory" && (
+              <button
+                onClick={() => setProjectMemoryOpen(true)}
+                className="h-7 text-[11px] font-medium px-2.5 rounded-md border border-accent/30 bg-accent/10 hover:bg-accent/20 text-accent inline-flex items-center gap-1.5 whitespace-nowrap"
+              >
+                <Plus className="w-3 h-3" />
+                {t("projectMemory.newButton")}
+              </button>
+            )}
           </div>
         )}
         <div className="p-4">
@@ -563,6 +591,15 @@ export function CcConfig() {
           onConfirm={handleDelete}
         />
       )}
+      {projectMemoryOpen && (
+        <ProjectMemoryModal
+          ns="ccConfig"
+          filename="CLAUDE.md"
+          template={t("projectMemory.template")}
+          onClose={() => setProjectMemoryOpen(false)}
+          onCreate={handleCreateProjectMemory}
+        />
+      )}
       {toast && <ToastNotice toast={toast} onDismiss={() => setToast(null)} />}
       {backupsOpen && <BackupsModal onClose={() => setBackupsOpen(false)} />}
       {profilesOpen && <ProfilesModal onClose={() => setProfilesOpen(false)} onToast={setToast} />}