feat(projects): show real git state on the project detail page

The page carried one bare `●` for "dirty" and nothing else, so "do I have
commits I haven't pushed" and "which worktree am I in" still meant dropping
into a terminal. Design mock: docs/mockups/project-detail-git.html; plan and
task breakdown (G1-G7): docs/plans/w6-project-git-panel.md.

One rule drives the whole feature: ahead/behind compare against `@{u}`, a
LOCALLY CACHED remote ref that only a fetch moves. This repo was the live
example while building — `↑9` true, `↓0` false, because FETCH_HEAD had not
moved in 19 days. So:

  - `ahead` needs only local refs and is never flagged.
  - `behind` is flagged `stale` once FETCH_HEAD is older than an hour.
  - Exactly ONE state may render green: ↑0 ↓0 AND a fresh fetch. Green means
    "I checked, ignore this"; getting it wrong is lying to the user.
  - No upstream (the normal state of a fresh worktree branch) leaves ahead and
    behind undefined — it renders an explicit `no upstream`, never the green
    path. That fall-through is the easiest bug to ship here.

What landed:

G1  SyncState (upstream/ahead/behind/lastFetchMs/detached) + ProjectDetail.sync
    and .dirtyCount. All additive and optional — the Android and iOS clients
    decode these shapes. The ahead/behind helper already existed for the list
    view; buildProjectDetail had simply never called it.
    Fixes a pre-existing bug on the way: readBranch read <repo>/.git/HEAD
    directly, so it returned nothing inside a LINKED worktree, where .git is a
    file. resolveGitDirs now resolves both the per-worktree gitdir (HEAD) and
    the shared common dir (FETCH_HEAD).

G2  POST /projects/git/fetch. Same discipline as push: the remote is derived
    server-side and no remote or refspec is ever read from the body, so a
    client cannot aim it at an arbitrary URL. Touches refs/remotes only — no
    working tree, no index, no merge; it is not a pull. Own rate-limit bucket
    so refreshes cannot eat the budget a real push needs. On failure
    lastFetchMs is left alone, so the UI keeps saying "stale" instead of
    pretending it refreshed.

G3  makeSyncBand replaces the bare dot: upstream name, ↑n, ↓n, stale flag,
    dirty count, Fetch button (disabled on a detached HEAD).

G4  The commit list marks unpushed commits and draws the upstream boundary
    once, after the last of them. Marking is server-side from `rev-list`,
    deliberately NOT "the first N rows": `git log` is date-ordered, so merging
    an older branch interleaves unpushed commits BELOW pushed ones, and that
    shortcut fails in the dangerous direction — calling an unpushed commit
    pushed. A regression test builds exactly that backdated-merge shape.

G5  The worktree section is always "Worktrees (n)" (it used to rename itself
    to "Branch" at n=1) and the current row carries its own state chips.

G6  Cost control. The plan called for a .git-mtime cache; that was dropped
    during implementation because a fingerprint over HEAD/index/reflog does
    NOT move when push updates a remote-tracking ref — the cached `ahead`
    would still claim "9 to push" right after a successful push, which is the
    exact lie the feature exists to prevent. Replaced with three measures that
    cannot go stale: in-flight coalescing (N devices watching one repo cost
    one probe, entry dropped as it settles, nothing cached across time),
    skipping the re-render when the payload is byte-identical (this also stops
    the 5 s re-mount of the commit log, two more git spawns per tick), and
    pausing the timer while the document is hidden.

G7  Per-worktree state via GET /projects/worktree/state, kept narrower than
    /projects/detail so N rows do not pay for worktree listing and CLAUDE.md
    reads nothing renders. Needed an unplanned prerequisite: ProjectSessionRef
    carried no cwd, so sessions could not be attributed to a worktree. Added
    it, plus countSessionsByWorktree, which matches DEEPEST-first because
    .claude/worktrees/<name> lives INSIDE the main checkout and prefix
    matching would count every worktree session against the parent repo too.

Out of scope, unchanged: no reset, no checkout, no clean, no rebase, no
force-push. stage/commit/push stay exactly as they were.

Verified: tsc and build clean; 46 new tests.

test/git-log.test.ts

@@ -149,3 +149,65 @@ describe('mountGitLog', () => {
     expect(host.querySelector('.proj-commit-row')).toBeNull()
   })
 })
+
+/* ── w6/G4 unpushed rows + the upstream boundary ───────────────────────────── */
+
+describe('renderGitLog — unpushed boundary (w6 G4)', () => {
+  function entry(hash: string, subject: string, unpushed?: boolean) {
+    return { hash, at: Date.now(), subject, ...(unpushed === true ? { unpushed: true } : {}) }
+  }
+
+  it('marks unpushed rows and draws the boundary exactly once, after the last one', () => {
+    const host = document.createElement('div')
+    renderGitLog(host, {
+      commits: [
+        entry('aaa1111', 'newest local', true),
+        entry('bbb2222', 'older local', true),
+        entry('ccc3333', 'already pushed'),
+        entry('ddd4444', 'also pushed'),
+      ],
+      truncated: false,
+      upstream: 'origin/develop',
+    })
+
+    expect(host.querySelectorAll('.proj-commit-unpushed').length).toBe(2)
+    const boundaries = host.querySelectorAll('.proj-commit-boundary')
+    expect(boundaries.length).toBe(1)
+    expect(boundaries[0]!.textContent).toContain('origin/develop')
+
+    const rows = Array.from(host.querySelectorAll('.proj-commit-row, .proj-commit-boundary'))
+    expect(rows[2]!.classList.contains('proj-commit-boundary')).toBe(true)
+  })
+
+  it('draws no boundary when nothing is unpushed', () => {
+    const host = document.createElement('div')
+    renderGitLog(host, {
+      commits: [entry('aaa1111', 'pushed')],
+      truncated: false,
+      upstream: 'origin/main',
+    })
+    expect(host.querySelector('.proj-commit-boundary')).toBeNull()
+    expect(host.querySelector('.proj-commit-unpushed')).toBeNull()
+  })
+
+  it('draws no boundary without an upstream, even if rows claim to be unpushed', () => {
+    const host = document.createElement('div')
+    renderGitLog(host, { commits: [entry('aaa1111', 'local', true)], truncated: false })
+    expect(host.querySelector('.proj-commit-boundary')).toBeNull()
+  })
+
+  it('treats a non-true `unpushed` from the server as pushed', () => {
+    const norm = normalizeGitLog({
+      commits: [{ hash: 'aaa1111', at: 1, subject: 's', unpushed: 'yes' }],
+      truncated: false,
+    })
+    expect(norm!.commits[0]!.unpushed).toBeUndefined()
+  })
+
+  it('keeps a string upstream and drops a junk one', () => {
+    expect(normalizeGitLog({ commits: [], truncated: false, upstream: 'origin/x' })!.upstream).toBe(
+      'origin/x',
+    )
+    expect(normalizeGitLog({ commits: [], truncated: false, upstream: 42 })!.upstream).toBeUndefined()
+  })
+})