feat: right-click menus everywhere, workspace/session cost, long-term DB safety

Right-click menus: one portal shell (components/ContextMenu.tsx) for every
item with actions - sidebar/Recents/archived session rows (SessionMenu),
console tabs, pane headers, the Changes panel's files/tree/commits, the
workspace home, sessions outside a workspace (SessionRowMenu: Sessions
table, Dashboard, Activity, Workflow runs), prompt images, every Settings
list and every Claude Code/Codex config list (FileItemMenu). Buttons stay;
a delete keeps its button's confirm; the shell stops portal clicks from
reaching the card that opened it.

Status bar: Workspace $ and Session $ on the Workspace page, from
?lane= on GET /api/pricing/cost and the focused/replayed session's cost.

Database, no data dropped: synchronous=NORMAL, journal_size_limit 64 MB,
hourly PASSIVE checkpoint + PRAGMA optimize, idx_events_session_created
(replacing the redundant idx_events_session), watchdog reads
sessions.transcript_path, transcript parsed before the hook's write
transaction, GET /api/sessions/:id?events=0 for the web page (reloads only
on its own session, debounced), streamed export, transactional clear-data
and chunked cleanup, subagent import reads tool_use_ids once, runtime logs
rotated past 5 MB.

server/__tests__/webhooks.test.js

@@ -375,6 +375,18 @@ describe("test probe + clear-data", () => {
     assert.equal(stmts.lastWebhookDeliveryForTarget.get(created.body.target.id), undefined);
     assert.ok(stmts.getWebhookTarget.get(created.body.target.id)); // target survives
   });
+
+  it("clear-data leaves no workflow run behind its cleared session, and turns foreign keys back on", async () => {
+    db.prepare(
+      "INSERT OR IGNORE INTO sessions (id, name, status, started_at, updated_at) VALUES ('wf-s', 'w', 'completed', '2026-01-01T00:00:00Z', '2026-01-01T00:00:00Z')"
+    ).run();
+    db.prepare("INSERT INTO workflows (run_id, session_id) VALUES ('wf-run', 'wf-s')").run();
+    const res = await post("/api/settings/clear-data");
+    assert.equal(res.status, 200);
+    assert.equal(db.prepare("SELECT COUNT(*) AS c FROM workflows").get().c, 0);
+    assert.equal(db.prepare("SELECT COUNT(*) AS c FROM sessions").get().c, 0);
+    assert.equal(db.pragma("foreign_keys", { simple: true }), 1);
+  });
 });
 
 describe("provider registry", () => {