feat(config): create a new project's memory file from Settings

The Memory tab could only show this machine's user memory and the
dashboard's own project file. Setting up a project you had not run
through the dashboard meant opening a terminal — `PUT /file`'s
"project" scope always resolves against the server's cwd, on purpose.

Add one narrow route per tool that writes into the directory you name:
CLAUDE.md for Claude Code, AGENTS.md for Codex, both through the same
`project-memory.js`. Being the only write path that honours a
caller-supplied directory, it pays for that:

  - the directory must be absolute and already exist — nothing is
    created for you;
  - the filename comes from the route, never from the body;
  - an existing file, symlink included, is a 409 — this can only
    create, never overwrite;
  - it sits behind the loopback-Origin guard /api/run uses, so a page
    in the user's browser cannot plant agent instructions in a project
    directory. That guard moves to lib/same-origin.js to be shared.

The modal takes the dashboard's known project dirs as suggestions on a
free-text input rather than a closed list: a project it has never seen
is exactly the case this exists for.

Mutation-checked: dropping the origin guard, and swapping lstat for
stat, each fail a test.

server/routes/codex-config.js

@@ -24,6 +24,8 @@ const { Router } = require("express");
 const codexDiscovery = require("../lib/codex-discovery");
 const codexMutate = require("../lib/codex-mutate");
 const codexCli = require("../lib/codex-cli");
+const projectMemory = require("../lib/project-memory");
+const { sameOriginGuard } = require("../lib/same-origin");
 const { broadcast } = require("../websocket");
 
 const router = Router();
@@ -56,9 +58,13 @@ const ERR_TO_STATUS = {
   EBADSCOPE: 400,
   EBADNAME: 400,
   EBADCONTENT: 400,
+  EBADDIR: 400,
+  EBADTOOL: 400,
   EOUTOFROOT: 400,
   ETOOLARGE: 413,
   ENOTFOUND: 404,
+  // The project already has an AGENTS.md; creating would clobber it.
+  EEXISTS: 409,
 };
 
 function mutateError(res, err) {
@@ -158,6 +164,24 @@ router.delete("/file", (req, res) => {
   }
 });
 
+/**
+ * POST /api/codex-config/project-memory — create `AGENTS.md` in a project the
+ * dashboard has never run in. Body: `{ dir, content }`. The Codex twin of
+ * cc-config.js's route of the same name; both go through project-memory.js,
+ * which is where the narrowing rules for this one caller-chosen write path
+ * are documented.
+ */
+router.post("/project-memory", sameOriginGuard, (req, res) => {
+  const { dir, content } = req.body || {};
+  try {
+    const result = projectMemory.createProjectMemory({ tool: "codex", dir, content });
+    emitChanged({ action: "write", scope: "project", type: "memory", name: null });
+    res.json({ ...result, created: true });
+  } catch (err) {
+    return mutateError(res, err);
+  }
+});
+
 router.get("/backups", (req, res) => {
   const scope =
     req.query.scope === "user" || req.query.scope === "project" ? req.query.scope : undefined;