feat(preview): agent driven browser previews + Markdown rendering

[aprv10]

Problem

The desktop browser panel could only ever auto-open a file literally named index.html (or its public/dist/build variants). Anything else an agent produced — a standalone report.html, a chart, a Markdown write-up — could not be surfaced in the panel. Markdown was doubly broken: even when pointed at directly, .md files were served by http.ServeFile as text/plain, so the webview showed raw source instead of a rendered document.

We wanted the agent to decide what to show (similar to how an artifact-aware coding tool opens a preview), while keeping index.html auto-opening as a zero-effort fallback.

What changed

• Markdown rendering. The preview/files route now converts .md/.markdown to a styled, self-contained HTML document (goldmark + GitHub-flavored extensions: tables, task lists, strikethrough, autolinks) and serves it as text/html. All other files are served verbatim as before, so the frontend needs no changes — a .md URL simply returns rendered HTML.
• Agent-driven previews. Worker sessions get a standing system-prompt instruction to run ao preview <file> proactively for artifacts a human should see (HTML pages, reports, charts, Markdown docs). This is the mechanism that makes "the agent decides what to open" actually happen; the command doc already documented the CLI usage.
• Conservative auto-open (poller). Discovery is split into DiscoverIndexEntry (index anchors only) and DiscoverEntry (index, then most-recently-modified previewable file). The background poller now uses index-only, so it auto-opens a real app entry but never guesses at loose files. The full most-recent fallback is kept only for a bare, agent-initiated ao preview.

The bug found and fixed along the way

While testing, ao preview report.html appeared to do nothing: the panel stayed blank and the session's previewRevision kept climbing while previewUrl stayed empty. Root cause: after the poller became index-only, any workspace without an index.html made it treat the agent's own /preview/files/... URL as stale and clear it on every ~250ms cycle — erasing the agent's explicit preview almost immediately. The poller now clears a preview only when it itself opened it for an index.html that has since disappeared, and never touches a preview the agent set explicitly.

Testing

• go test ./internal/preview/... ./internal/httpd/controllers/... — passes. New/updated tests cover: index precedence and most-recent fallback, the index-only discovery used by the poller, Markdown rendering (HTML document, GFM table, title escaping), the poller ignoring loose non-index files, and the regression fix (TestPollerPreservesExplicitNonIndexPreview — the poller must leave an agent-set non-index preview untouched across multiple poll cycles).
• Verified live in the app: index.html still auto-opens; ao preview sample.html and ao preview test.md (relative paths) both persist and render, with Markdown shown as a formatted document rather than raw text.

Files affected

• backend/internal/preview/entry.go — split discovery into DiscoverIndexEntry (index-only) and DiscoverEntry (index + most-recent fallback); added IsMarkdownPath.
• backend/internal/preview/markdown.go (new) — goldmark-based RenderMarkdown with an embedded light/dark stylesheet.
• backend/internal/preview/poller.go — poller uses index-only discovery and only clears previews it opened, never the agent's.
• backend/internal/httpd/controllers/sessions.go — previewFile renders Markdown to HTML; other files unchanged.
• backend/internal/session_manager/manager.go — standing worker prompt block instructing proactive ao preview <file>.
• backend/internal/preview/entry_test.go, markdown_test.go (new), poller_test.go — coverage for the above.
• backend/go.mod, backend/go.sum — goldmark dependency (promoted from indirect).