Add document download

[exilis]

Summary

• Adds a download button (⤓) in the tab bar that downloads the currently-open document — the original bytes on disk, with the original filename.
• Works for every document type reefdoc opens (markdown, Allium, code, PDF, DOCX, XLSX, PPTX).
• Server: new opt-in ?download=1 mode on /api/file sets a sanitized Content-Disposition: attachment header; existing inline behavior, path-safety, and content-type handling are unchanged.
• Frontend: pure downloadUrl(path) builder, a refreshDownloadButton() visibility helper wired into every active-document state change, native browser download via a temporary <a download>.

Test coverage (4 layers)

• Go handler unit (server_test.go): header set, basename, filename sanitization (CRLF/quote injection blocked), inline-preservation, body-unchanged.
• HTTP-level E2E (e2e_test.go): ?download=1 over a real httptest server asserts Content-Disposition and that inline requests omit it.
• JS unit (app.test.js): pure downloadUrl builder incl. encoding of spaces, slashes, and query-delimiter chars.
• Browser E2E (web/e2e/download.e2e.js, Playwright + Chromium): builds and drives the real binary; asserts button hidden→appears, text download (byte-exact content), binary download fidelity, and hides after closing the last tab. Verified with a teeth-check (tests fail when the feature is broken). New isolated CI e2e job; dev-only dependency, shipped binary unchanged.

Design & plans

• Specs: docs/specs/2026-06-26-document-download-design.md, docs/specs/2026-06-26-download-e2e-design.md
• Plans: docs/plans/2026-06-26-document-download.md, docs/plans/2026-06-26-download-e2e.md

Test Plan

• go test -race ./... — pass
• npm test — 60/60 (unit; does not run the e2e file)
• npm run e2e — 5/5 (Playwright, real binary)
• go vet / gofmt -l clean
• Browser E2E now provides the automated click→download smoke coverage