MCP: add_project lets agents register a folder on their own device

[jsgrrchg]

Summary

Agents can now add a folder as a Zeron project through a new add_project MCP tool, so a flow like "clone this repo and start a chat in it" no longer stops at the UI.

• Own device only. add_project {path, name?} adds folders on the device the chat runs on, where the agent has a shell and can see the disk. Passing another device fails with a pointer to the workaround: create a chat there and have it call add_project. The new AddProject RPC is not forwardable and refuses a targetDeviceId naming another device.
• Validated in the engine. The path has ~ expanded and is canonicalized (symlinks and .. resolved). It must be an existing folder inside the user's home, and not the home itself.
• Idempotent. A folder that is already a project, under any spelling that resolves to it (trailing slash, symlink), returns the existing project with created: false. The check and the insert run under one registry lock, so concurrent adds of the same folder make one project. create_space (the picker path) also treats /a/b/ and /a/b as the same folder now.
• Attributed and undoable. Space gains createdByChatId. When an agent-added project appears, the UI shows a toast saying which chat added it, with Undo. Undo removes an empty project at once, and opens the usual confirm dialog if the project has sessions.
• Toasts can carry an action. toast::show_with_action adds a trailing button. Toasts with an action never merge with a repeat.
• Side chats cannot add projects, same rule as create_chat.

Fixes along the way

• The Remove project dialog (and Undo) count every chat the cascade deletes, including archived and side chats. They used chats_in_space, which skips both, so the dialog could say "0 sessions" and still delete some.

Notes

• createdByChatId is a new optional field on space rows (both doc backends and the registry seed). Older readers ignore it.
• cargo fmt --check reports diffs only in code this PR doesn't touch.

Follow-ups

• remove_project for agents: remove at once only when the project has no chats (archived and side chats included); otherwise ask through the Remove dialog. Never the calling chat's own project or its parent's.
• Archive a project instead of deleting it, so removing one keeps its sessions (today the registry cascade deletes them).
• find_folders if adding projects on another device is wanted again.

Testing

• cargo test -p zeron-mcp: 30 pass. They cover the local call, attribution, refusing another device, and side chats being refused.
• cargo test -p zeron-proto -p zeron-doc -p zeron-rpc -p zeron-client: pass.
• zeron-engine lib tests for path resolution (~, .., trailing slash, symlink escape, home itself, files, missing paths), dedupe on the resolved folder, 32 concurrent adds making one project, and AddProject not being forwardable.
• zeron-engine --test device_routing mcp_standalone_session_executes_on_the_selected_device: MCP refuses add_project toward device B, a raw AddProject aimed at B is not forwarded and adds nothing on B, and create_chat still runs its turn on B.
• zeron-ui lib tests: agent-added projects are announced once and only while watching, the delete count includes archived and side chats, and action toasts stack.
• Three zeron-ui markdown drag/truncation tests fail under parallel runs on main too, and pass with --test-threads=1. They are unrelated to this change.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}