feat(ui): canvas-first redesign with a self-hosted draw.io (#957)

The canvas now fills the window and the chat floats on its right. draw.io is
served from our own origin (public/drawio, downloaded at build time and
checked against the release's SHA-256), so the app can drive the editor
directly:

- every AI change becomes a version card with a thumbnail; compare, restore
  or undo it, and Ctrl+Z on the canvas takes an AI change back in one step
- shapes the AI just changed are highlighted on the canvas
- selected shapes appear as a chip and are sent to the model
- draw.io's own simple UI: its toolbar, menus (auto layout, Mermaid, CSV
  import) and page tabs; the shape library starts closed
- new start screen, session rename and switcher, open .drawio files
- settings split into Models & keys, Appearance, Advanced and About
- Bedrock in the model settings also takes an API key instead of access keys
- phones switch between canvas and chat
- dark mode uses draw.io's own dark mode, with neutral greys around it

With an external draw.io (NEXT_PUBLIC_DRAWIO_BASE_URL) the features above
that need same origin are off.

The chat logic moved from the 1500-line chat panel into a chat engine plus
small UI components; zustand holds canvas, versions, settings and UI state.

tests/unit/validate-model-bedrock.test.ts

@@ -31,4 +31,38 @@ describe("testing Bedrock", () => {
         )
         expect(factory.overrides.awsSessionToken).toBe("session-token")
     })
+
+    it("takes a Bedrock API key instead of access keys", async () => {
+        factory.overrides = null
+        await validateModel(
+            new Request("http://localhost/api/validate-model", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    provider: "bedrock",
+                    modelId: "amazon.nova-lite-v1:0",
+                    apiKey: "bedrock-api-key",
+                    awsRegion: "us-east-1",
+                }),
+            }),
+        )
+        expect(factory.overrides.apiKey).toBe("bedrock-api-key")
+    })
+
+    it("still needs a region with an API key", async () => {
+        factory.overrides = null
+        const response = await validateModel(
+            new Request("http://localhost/api/validate-model", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    provider: "bedrock",
+                    modelId: "amazon.nova-lite-v1:0",
+                    apiKey: "bedrock-api-key",
+                }),
+            }),
+        )
+        expect(response.status).toBe(400)
+        expect(factory.overrides).toBeNull()
+    })
 })