fix: open local file links with Ctrl/Cmd-click

[Zhangs-11]

Summary

• preserve file:// Markdown destinations when Pi Web has an in-app file handler
• open local files through the existing preview pane for plain clicks, macOS Command-clicks, and Windows/Linux Ctrl-clicks
• apply the same behavior to chat messages and Markdown file previews
• keep external links and secondary click modifiers on their existing browser paths

Problem

Pi Web already resolves local Markdown links into its allow-listed file preview, but two guards prevented the reported interaction:

1. React Markdown's default URL transform replaced file:// destinations with an empty href before Pi Web could resolve them.
2. Both local-link click handlers ignored metaKey and ctrlKey, leaving the browser to navigate from an HTTP page to a file:// URL, which browsers block.

As a result, Command-clicking a local HTML report on macOS or Ctrl-clicking it on Windows/Linux appeared to do nothing.

Behavior

A primary-modifier left click now uses the same in-app preview as a plain click. Shift/Alt clicks, middle clicks, already-prevented events, and external links remain unchanged.

Security

file:// destinations are preserved only when the renderer has Pi Web's onOpenFile handler. The existing file resolver and /api/files allow-list remain the authorization boundary; this change does not grant access to additional filesystem paths.

Testing

• npm test — 847 tests passed
• node_modules/.bin/tsc --noEmit
• npm run lint
• real Pi Web development server and real GPT-5.6 Sol round on commit 113dad6f1be8babb12a1b3f0bddae283d3995843
• browser verification: macOS Command-click opened the generated local HTML report in Pi Web's preview pane; unit coverage verifies both metaKey and ctrlKey

Demo

Recorded from commit 113dad6f1be8babb12a1b3f0bddae283d3995843 using that worktree’s real Next.js development server, a fresh isolated agent directory, workspace, and browser context. A real GPT-5.6 Sol round ran through Pi Web’s normal RPC transport; no fixtures, mock transport, synthetic events, personal sessions, or project documents were used.