feat(ui): canvas-first redesign with a self-hosted draw.io (#957)

The canvas now fills the window and the chat floats on its right. draw.io is
served from our own origin (public/drawio, downloaded at build time and
checked against the release's SHA-256), so the app can drive the editor
directly:

- every AI change becomes a version card with a thumbnail; compare, restore
  or undo it, and Ctrl+Z on the canvas takes an AI change back in one step
- shapes the AI just changed are highlighted on the canvas
- selected shapes appear as a chip and are sent to the model
- draw.io's own simple UI: its toolbar, menus (auto layout, Mermaid, CSV
  import) and page tabs; the shape library starts closed
- new start screen, session rename and switcher, open .drawio files
- settings split into Models & keys, Appearance, Advanced and About
- Bedrock in the model settings also takes an API key instead of access keys
- phones switch between canvas and chat
- dark mode uses draw.io's own dark mode, with neutral greys around it

With an external draw.io (NEXT_PUBLIC_DRAWIO_BASE_URL) the features above
that need same origin are off.

The chat logic moved from the 1500-line chat panel into a chat engine plus
small UI components; zustand holds canvas, versions, settings and UI state.

env.example

@@ -143,8 +143,11 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # SETTINGS_FILE=./data/settings.json  # Optional: custom settings file location
 
 # Draw.io Configuration (Optional)
-# NEXT_PUBLIC_DRAWIO_BASE_URL=https://embed.diagrams.net  # Default: https://embed.diagrams.net
-# Use this to point to a self-hosted draw.io instance
+# By default the app serves its own copy of draw.io from /drawio (downloaded into
+# public/drawio by `npm run dev` / `npm run build`). Same origin is required for
+# highlighting AI changes, asking about selected shapes and the custom toolbar.
+# NEXT_PUBLIC_DRAWIO_BASE_URL=https://embed.diagrams.net  # Optional: use an external draw.io instead
+# With an external draw.io the app falls back to draw.io's own toolbar and those features are off.
 
 # Subdirectory Deployment (Optional)
 # For deploying to a subdirectory (e.g., https://example.com/nextaidrawio)
@@ -178,7 +181,7 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # which triggers the client UI to display messages suggesting self-hosting or sponsorship.
 # This switch allows self-hosted users to provide custom messages in response to a 429 code,
 # in messageTokenSelfHosted, messageApiSelfHosted, and tipSelfHosted translation strings.
-# It also turns off the MCP server advertisement in the chat examples.
+# It also turns off the MCP server advertisement in Settings > About.
 # NEXT_PUBLIC_SELFHOSTED=true
 
 # Minimax Configuration (Optional)