security(main): dialog-grant admission for local paths, explicit webPreferences

New localPathGrants.ts: an in-memory registry of paths the user picked in a
native dialog. Every check resolves realpath + stat at grant and use time;
Windows case folding; missing files, directories-as-files, devices and
symlinked parents can never pass. SFTP upload/download and zmodem send/
receive now refuse renderer-supplied local paths that were never granted,
returning the resolved path so callers never re-traverse a symlink. keyPath
is validated as a regular file <= 1MB before reading (a device node would
have blocked the UI thread forever). Tests inject a stub policy via
setLocalPathPolicy; production always defaults to the real registry.

Also: webPreferences now explicitly pins contextIsolation/nodeIntegration/
webSecurity instead of relying on defaults.

New offline test tests/local-path-grants.mjs (37 assertions incl. symlink
escape); offline suite grows to 13. i18n: 6 main.sftp/main.key error keys
in 4 languages.

src/main/index.ts

@@ -157,6 +157,14 @@ function createWindow(): void {
     ...(existsSync(devIcon) ? { icon: nativeImage.createFromPath(devIcon) } : {}),
     webPreferences: {
       preload: join(__dirname, '../preload/index.js'),
+      // Written out explicitly even though every value matches Electron's
+      // current default: these are the three that keep the renderer unable to
+      // reach the main process, and a default that silently changed (or a
+      // future Electron release flipping one) must not be the only thing
+      // holding that line. See also the sender guard in ipc.ts.
+      contextIsolation: true,
+      nodeIntegration: false,
+      webSecurity: true,
       // Keep the default renderer sandbox (preload only touches the electron
       // IPC bridge, so it does not need Node access).
       sandbox: true