feat(projects): show real git state on the project detail page

The page carried one bare `●` for "dirty" and nothing else, so "do I have
commits I haven't pushed" and "which worktree am I in" still meant dropping
into a terminal. Design mock: docs/mockups/project-detail-git.html; plan and
task breakdown (G1-G7): docs/plans/w6-project-git-panel.md.

One rule drives the whole feature: ahead/behind compare against `@{u}`, a
LOCALLY CACHED remote ref that only a fetch moves. This repo was the live
example while building — `↑9` true, `↓0` false, because FETCH_HEAD had not
moved in 19 days. So:

  - `ahead` needs only local refs and is never flagged.
  - `behind` is flagged `stale` once FETCH_HEAD is older than an hour.
  - Exactly ONE state may render green: ↑0 ↓0 AND a fresh fetch. Green means
    "I checked, ignore this"; getting it wrong is lying to the user.
  - No upstream (the normal state of a fresh worktree branch) leaves ahead and
    behind undefined — it renders an explicit `no upstream`, never the green
    path. That fall-through is the easiest bug to ship here.

What landed:

G1  SyncState (upstream/ahead/behind/lastFetchMs/detached) + ProjectDetail.sync
    and .dirtyCount. All additive and optional — the Android and iOS clients
    decode these shapes. The ahead/behind helper already existed for the list
    view; buildProjectDetail had simply never called it.
    Fixes a pre-existing bug on the way: readBranch read <repo>/.git/HEAD
    directly, so it returned nothing inside a LINKED worktree, where .git is a
    file. resolveGitDirs now resolves both the per-worktree gitdir (HEAD) and
    the shared common dir (FETCH_HEAD).

G2  POST /projects/git/fetch. Same discipline as push: the remote is derived
    server-side and no remote or refspec is ever read from the body, so a
    client cannot aim it at an arbitrary URL. Touches refs/remotes only — no
    working tree, no index, no merge; it is not a pull. Own rate-limit bucket
    so refreshes cannot eat the budget a real push needs. On failure
    lastFetchMs is left alone, so the UI keeps saying "stale" instead of
    pretending it refreshed.

G3  makeSyncBand replaces the bare dot: upstream name, ↑n, ↓n, stale flag,
    dirty count, Fetch button (disabled on a detached HEAD).

G4  The commit list marks unpushed commits and draws the upstream boundary
    once, after the last of them. Marking is server-side from `rev-list`,
    deliberately NOT "the first N rows": `git log` is date-ordered, so merging
    an older branch interleaves unpushed commits BELOW pushed ones, and that
    shortcut fails in the dangerous direction — calling an unpushed commit
    pushed. A regression test builds exactly that backdated-merge shape.

G5  The worktree section is always "Worktrees (n)" (it used to rename itself
    to "Branch" at n=1) and the current row carries its own state chips.

G6  Cost control. The plan called for a .git-mtime cache; that was dropped
    during implementation because a fingerprint over HEAD/index/reflog does
    NOT move when push updates a remote-tracking ref — the cached `ahead`
    would still claim "9 to push" right after a successful push, which is the
    exact lie the feature exists to prevent. Replaced with three measures that
    cannot go stale: in-flight coalescing (N devices watching one repo cost
    one probe, entry dropped as it settles, nothing cached across time),
    skipping the re-render when the payload is byte-identical (this also stops
    the 5 s re-mount of the commit log, two more git spawns per tick), and
    pausing the timer while the document is hidden.

G7  Per-worktree state via GET /projects/worktree/state, kept narrower than
    /projects/detail so N rows do not pay for worktree listing and CLAUDE.md
    reads nothing renders. Needed an unplanned prerequisite: ProjectSessionRef
    carried no cwd, so sessions could not be attributed to a worktree. Added
    it, plus countSessionsByWorktree, which matches DEEPEST-first because
    .claude/worktrees/<name> lives INSIDE the main checkout and prefix
    matching would count every worktree session against the parent repo too.

Out of scope, unchanged: no reset, no checkout, no clean, no rebase, no
force-push. stage/commit/push stay exactly as they were.

Verified: tsc and build clean; 46 new tests.

src/http/git-log.ts

@@ -102,8 +102,67 @@ export async function getGitLog(repoPath: string, opts: GetGitLogOptions): Promi
       ['log', '--no-color', '-z', '-n', String(n), '--format=%h%x1f%ct%x1f%s'],
       { cwd: repoPath, timeout: opts.timeoutMs, maxBuffer: GIT_LOG_MAX_BUFFER },
     )
-    return parseGitLog(stdout, n)
+    const parsed = parseGitLog(stdout, n)
+    return await markUnpushed(repoPath, parsed, opts.timeoutMs)
   } catch {
     return { commits: [], truncated: false }
   }
 }
+
+/** Cap on how many unpushed commits we enumerate — a runaway branch must not
+ *  turn one log read into an unbounded buffer. */
+const UNPUSHED_MAX = 200
+
+/**
+ * w6/G4 — tag the commits that exist only locally, and name the upstream so the
+ * client can draw the boundary between pushed and unpushed history.
+ *
+ * Marking is done HERE, from the authoritative `rev-list` set, and never inferred
+ * on the client from row order: `git log` is date-ordered, so merging an older
+ * branch interleaves unpushed commits below pushed ones and "the first N rows are
+ * unpushed" silently mislabels them as pushed — the same class of confident lie
+ * the sync band exists to prevent.
+ *
+ * No upstream / detached / empty repo → the input is returned untouched (no
+ * `upstream`, no marks), so the client draws no boundary. Never throws.
+ */
+async function markUnpushed(
+  repoPath: string,
+  result: GitLogResult,
+  timeoutMs: number,
+): Promise<GitLogResult> {
+  if (result.commits.length === 0) return result
+
+  let upstream: string
+  try {
+    const { stdout } = await execFileAsync(
+      'git',
+      ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}'],
+      { cwd: repoPath, timeout: timeoutMs, maxBuffer: GIT_LOG_MAX_BUFFER },
+    )
+    upstream = stdout.trim()
+    if (upstream === '') return result
+  } catch {
+    return result // no upstream configured / detached — nothing to compare against
+  }
+
+  let fullHashes: string[]
+  try {
+    const { stdout } = await execFileAsync(
+      'git',
+      ['rev-list', `--max-count=${UNPUSHED_MAX}`, '@{u}..HEAD'],
+      { cwd: repoPath, timeout: timeoutMs, maxBuffer: GIT_LOG_MAX_BUFFER },
+    )
+    fullHashes = stdout.split('\n').map((l) => l.trim()).filter((l) => l !== '')
+  } catch {
+    return result
+  }
+
+  // `hash` is abbreviated (%h) while rev-list yields full SHAs, and the two can
+  // disagree on width, so match by prefix rather than equality. Bounded by
+  // GIT_LOG_MAX × UNPUSHED_MAX string compares — trivial, and always correct.
+  const commits = result.commits.map((c) =>
+    fullHashes.some((full) => full.startsWith(c.hash)) ? { ...c, unpushed: true } : c,
+  )
+  return { ...result, commits, upstream }
+}