fix: resolve symlinks in project directory paths (#1316)

* fix: resolve symlinks in project directory paths

OpenCode stores sessions using the canonical (realpath) directory, but
OpenChamber passed the unresolved symlink path in several places. The
string-match directory filter would fail when a project was accessed via
a symlink, making sessions invisible.

Changes:

- Add safeRealpathSync to settings normalization — project paths and
  lastDirectory are canonicalized at persistence time
- Add Express middleware before the API proxy to resolve symlinks in
  ?directory= query params on in-flight requests
- Resolve symlinks in /api/fs/list so the directory browser returns
  canonical paths, allowing the "already added" check to work correctly
- Reconcile the in-memory projects store when the server responds with
  normalized paths, preventing temporary duplicates

Fixes #1315

* fix: avoid sync realpath in opencode proxy

---------

Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>

packages/web/server/lib/path-realpath-cache.test.js

@@ -0,0 +1,75 @@
+import { describe, expect, it } from 'vitest';
+
+import { createRealpathCache } from './path-realpath-cache.js';
+
+describe('createRealpathCache', () => {
+  it('caches successful realpath lookups until the success TTL expires', async () => {
+    let now = 1_000;
+    let calls = 0;
+    const cache = createRealpathCache({
+      now: () => now,
+      successTtlMs: 1_000,
+      realpath: async () => {
+        calls += 1;
+        return `/real-${calls}`;
+      },
+    });
+
+    await expect(cache.resolve('/link')).resolves.toBe('/real-1');
+    await expect(cache.resolve('/link')).resolves.toBe('/real-1');
+    expect(calls).toBe(1);
+
+    now += 1_001;
+    await expect(cache.resolve('/link')).resolves.toBe('/real-2');
+    expect(calls).toBe(2);
+  });
+
+  it('shares in-flight realpath lookups for the same path', async () => {
+    let calls = 0;
+    let release = () => undefined;
+    const pending = new Promise((resolve) => {
+      release = () => resolve('/real/path');
+    });
+    const cache = createRealpathCache({
+      realpath: async () => {
+        calls += 1;
+        return pending;
+      },
+    });
+
+    const first = cache.resolve('/link/path');
+    const second = cache.resolve('/link/path');
+    await Promise.resolve();
+
+    expect(calls).toBe(1);
+    release();
+    await expect(Promise.all([first, second])).resolves.toEqual(['/real/path', '/real/path']);
+  });
+
+  it('throws realpath failures by default', async () => {
+    const error = Object.assign(new Error('missing'), { code: 'ENOENT' });
+    const cache = createRealpathCache({
+      realpath: async () => {
+        throw error;
+      },
+    });
+
+    await expect(cache.resolve('/missing')).rejects.toBe(error);
+  });
+
+  it('can fall back to the original path and cache failures briefly', async () => {
+    let calls = 0;
+    const cache = createRealpathCache({
+      fallbackOnError: true,
+      failureTtlMs: 1_000,
+      realpath: async () => {
+        calls += 1;
+        throw new Error('missing');
+      },
+    });
+
+    await expect(cache.resolve('/missing')).resolves.toBe('/missing');
+    await expect(cache.resolve('/missing')).resolves.toBe('/missing');
+    expect(calls).toBe(1);
+  });
+});