feat(ui): canvas-first redesign with a self-hosted draw.io (#957)

The canvas now fills the window and the chat floats on its right. draw.io is
served from our own origin (public/drawio, downloaded at build time and
checked against the release's SHA-256), so the app can drive the editor
directly:

- every AI change becomes a version card with a thumbnail; compare, restore
  or undo it, and Ctrl+Z on the canvas takes an AI change back in one step
- shapes the AI just changed are highlighted on the canvas
- selected shapes appear as a chip and are sent to the model
- draw.io's own simple UI: its toolbar, menus (auto layout, Mermaid, CSV
  import) and page tabs; the shape library starts closed
- new start screen, session rename and switcher, open .drawio files
- settings split into Models & keys, Appearance, Advanced and About
- Bedrock in the model settings also takes an API key instead of access keys
- phones switch between canvas and chat
- dark mode uses draw.io's own dark mode, with neutral greys around it

With an external draw.io (NEXT_PUBLIC_DRAWIO_BASE_URL) the features above
that need same origin are off.

The chat logic moved from the 1500-line chat panel into a chat engine plus
small UI components; zustand holds canvas, versions, settings and UI state.

tests/unit/bedrock-api-key.test.ts

@@ -0,0 +1,47 @@
+// @vitest-environment node
+// The real Bedrock SDK, with the server's own AWS keys in the environment
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
+import { getAIModel } from "@/lib/ai-providers"
+
+const prompt = [
+    { role: "user" as const, content: [{ type: "text" as const, text: "hi" }] },
+]
+let sent: string[] = []
+
+beforeEach(() => {
+    vi.stubEnv("AWS_ACCESS_KEY_ID", "AKIASERVERKEY")
+    vi.stubEnv("AWS_SECRET_ACCESS_KEY", "server-secret")
+    vi.stubEnv("AWS_BEARER_TOKEN_BEDROCK", "")
+    sent = []
+    vi.stubGlobal("fetch", async (_url: unknown, init?: RequestInit) => {
+        sent.push(new Headers(init?.headers).get("authorization") ?? "")
+        return new Response("{}", { status: 400 })
+    })
+})
+afterEach(() => {
+    vi.unstubAllGlobals()
+    vi.unstubAllEnvs()
+})
+
+const run = async (apiKey: string) => {
+    const { model } = getAIModel({
+        provider: "bedrock",
+        modelId: "amazon.nova-lite-v1:0",
+        apiKey,
+        awsRegion: "us-east-1",
+    })
+    await (model as any).doGenerate({ prompt }).catch(() => {})
+}
+
+describe("a Bedrock API key from the user", () => {
+    it("never lets the request fall back to the server's AWS keys", async () => {
+        // The SDK drops a key of spaces
+        await run("   ")
+        expect(sent.some((auth) => auth.includes("AKIASERVERKEY"))).toBe(false)
+    })
+
+    it("is sent as the bearer token", async () => {
+        await run("user-key")
+        expect(sent).toEqual(["Bearer user-key"])
+    })
+})