feat: right-click menus everywhere, workspace/session cost, long-term DB safety

Right-click menus: one portal shell (components/ContextMenu.tsx) for every
item with actions - sidebar/Recents/archived session rows (SessionMenu),
console tabs, pane headers, the Changes panel's files/tree/commits, the
workspace home, sessions outside a workspace (SessionRowMenu: Sessions
table, Dashboard, Activity, Workflow runs), prompt images, every Settings
list and every Claude Code/Codex config list (FileItemMenu). Buttons stay;
a delete keeps its button's confirm; the shell stops portal clicks from
reaching the card that opened it.

Status bar: Workspace $ and Session $ on the Workspace page, from
?lane= on GET /api/pricing/cost and the focused/replayed session's cost.

Database, no data dropped: synchronous=NORMAL, journal_size_limit 64 MB,
hourly PASSIVE checkpoint + PRAGMA optimize, idx_events_session_created
(replacing the redundant idx_events_session), watchdog reads
sessions.transcript_path, transcript parsed before the hook's write
transaction, GET /api/sessions/:id?events=0 for the web page (reloads only
on its own session, debounced), streamed export, transactional clear-data
and chunked cleanup, subagent import reads tool_use_ids once, runtime logs
rotated past 5 MB.

scripts/plugin-update-helper.js

@@ -29,6 +29,7 @@
  */
 
 const fs = require("fs");
+const { rotateIfLarge } = require("./log-rotate");
 const path = require("path");
 const { execFileSync, spawnSync } = require("child_process");
 
@@ -45,6 +46,7 @@ const SAFE_NAME = /^[A-Za-z0-9][\w.-]*$/;
 
 function log(line) {
   try {
+    rotateIfLarge(LOG_FILE);
     fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] ${line}\n`);
   } catch {
     /* best effort */