react-doctor deferred follow-ups: structural refactors, design calls, semantics review

[dvaJi]

Follow-ups from react-doctor triage (deferred buckets)

Tracking issue for the findings consciously deferred in the react-doctor triage
(#76, fixed in PR #77). After that merge: score 65 · 142 findings · 0 errors
(baseline was score 51 · 1603 · 1 error). This issue tracks the deferred work so
it doesn't get lost; work it in the order below.

1. Build-time React Compiler (do first — it unblocks #2)

Enable @vitejs/plugin-react compiler: true + oxc-transform-react. Then
re-enable in doctor.config.jsonc and do the removal pass with measurements:

• react-compiler-no-manual-memoization (currently off — manual memoization is
  the only memoization until the compiler is live)

2. Structural refactors (~67 findings)

• no-giant-component ×47 — split incrementally, one component per PR, visual
  smoke-test each
• no-multi-component-file ×9 — move to their own files
• prefer-useReducer ×5, no-many-boolean-props ×5, jsx-max-depth ×1

3. Design decisions needed (~19)

• a11y (15): accordion headers containing switches (BuiltinKnowledge/Dify/
  FastGpt/Ragflow settings), frameless-widget drag surface (FloatingButton),
  provider rows with nested interactives (ModelProviderSettings), radio rows
  already served by RadioGroup (DataSettings), guide-tracking action rows
  (McpSettings), SkillCard — each needs an interaction-design call
• rendering-svg-precision ×3: reducing path precision alters rendered
  geometry — needs visual sign-off
• prefer-tag-over-role ×1: ThreadSidebarRow has nested interactives inside
  role="button" — needs a design answer for rename-in-place

4. iframe-missing-sandbox ×1 (product/security decision)

HTMLArtifact uses allow-scripts allow-same-origin so LLM-generated artifacts
can render; the combo lets content drop its own sandbox. Dropping
allow-same-origin needs testing against real artifacts.

5. Semantics review (~26)

• async-await-in-loop ×13: sequential awaits in loops — batching to
  Promise.all changes server-ordering semantics; review each site
  (KnowledgeFile, McpBuiltinMarket, ModelProviderSettingsDetail,
  useChatInputFiles ×2, BrowserPanel, useWorkspaceSync, mcp.ts ×2,
  modelStore ×3, ollamaStore)
• no-pass-live-state-to-parent ×4 / no-pass-data-to-parent ×4 /
  no-prop-callback-in-effect ×5: state pushed up through effect callbacks —
  small state-architecture changes per site

Rule posture

doctor.config.jsonc currently disables 3 rules with inline rationale
(memoization policy ×2, classic exhaustive-deps superseded by oxlint's
compiler rules). Verified false positives live in
.react-doctor/false-positives.md with predicates — re-verify when touching
those sites.

[dvaJi]

Second pass pushed to master (319c5d2): the codemod-exposed findings (33) are cleared. Score is now 65 · 147 findings · 0 errors (was 51 · 1603 · 1 error before the triage started).

Note: this commit went directly to master instead of through a PR. If you prefer a PR-based flow for this changeset, it can be reverted and resubmitted.

Section 5 cleared:
erender-state-only-in-handlers (16) — all converted to refs in the codemod/second pass.

Remaining 142: structural (68), a11y design (15), async-await-in-loop (13), state-flow (13), documented FPs (28), misc (5).