feat(config): create a new project's memory file from Settings

The Memory tab could only show this machine's user memory and the
dashboard's own project file. Setting up a project you had not run
through the dashboard meant opening a terminal — `PUT /file`'s
"project" scope always resolves against the server's cwd, on purpose.

Add one narrow route per tool that writes into the directory you name:
CLAUDE.md for Claude Code, AGENTS.md for Codex, both through the same
`project-memory.js`. Being the only write path that honours a
caller-supplied directory, it pays for that:

  - the directory must be absolute and already exist — nothing is
    created for you;
  - the filename comes from the route, never from the body;
  - an existing file, symlink included, is a 409 — this can only
    create, never overwrite;
  - it sits behind the loopback-Origin guard /api/run uses, so a page
    in the user's browser cannot plant agent instructions in a project
    directory. That guard moves to lib/same-origin.js to be shared.

The modal takes the dashboard's known project dirs as suggestions on a
free-text input rather than a closed list: a project it has never seen
is exactly the case this exists for.

Mutation-checked: dropping the origin guard, and swapping lstat for
stat, each fail a test.

server/routes/cc-config.js

@@ -29,6 +29,8 @@ const ccMutate = require("../lib/cc-mutate");
 const ccCli = require("../lib/cc-plugin-cli");
 const ccMcpCli = require("../lib/cc-mcp-cli");
 const ccProfiles = require("../lib/cc-profiles");
+const projectMemory = require("../lib/project-memory");
+const { sameOriginGuard } = require("../lib/same-origin");
 const { broadcast } = require("../websocket");
 
 const router = Router();
@@ -48,6 +50,10 @@ const ERR_TO_STATUS = {
   EBADNAME: 400,
   EBADPROJECT: 400,
   EBADCONTENT: 400,
+  EBADDIR: 400,
+  EBADTOOL: 400,
+  // The project already has a memory file; creating would clobber it.
+  EEXISTS: 409,
   ETOOLARGE: 413,
   EOUTOFROOT: 400,
   ENOTFOUND: 404,
@@ -216,6 +222,27 @@ router.delete("/file", (req, res) => {
   }
 });
 
+/**
+ * POST /api/cc-config/project-memory — create `CLAUDE.md` in a project the
+ * dashboard has never run in. Body: `{ dir, content }`.
+ *
+ * The one write here that honours a caller-supplied directory, which is the
+ * whole point: you cannot bootstrap a NEW project's memory from a writer
+ * pinned to the server's own cwd. It stays narrow — see project-memory.js —
+ * and sits behind the same loopback-origin guard the process-spawning routes
+ * use, so a random web page cannot plant instructions in a project directory.
+ */
+router.post("/project-memory", sameOriginGuard, (req, res) => {
+  const { dir, content } = req.body || {};
+  try {
+    const result = projectMemory.createProjectMemory({ tool: "claude", dir, content });
+    emitChanged({ action: "write", scope: "project", type: "memory", name: null });
+    res.json({ ...result, created: true });
+  } catch (err) {
+    return mutateError(res, err);
+  }
+});
+
 // ── Plugins / marketplaces (via the `claude` CLI) ──────────────────────
 //
 // These shell out to `claude plugin …` with an argv array — never a shell