Harden CatPilot canvas and add cross-partition aggregation

[tanure]

Mirrors the fixes made for the awesome-copilot submission (PR #2359) so the in-repo .github/extensions/catpilot-canvas extension stays identical to the published one.

Security & correctness

• Block cross-origin / non-loopback API requests (Host, Origin and Sec-Fetch-Site guards).
• Harden memo/note reads against path traversal (basename + parent-dir checks); sanitize returned filenames.
• Escape markdown table cells (pipes/newlines) on write and decode on read so task/milestone fields round-trip safely.
• Migration never overwrites: skip existing destinations, report skipped items, and validate the whole plan before persisting. Config changes now persist to the resolved config path.

Cross-partition aggregation

• Dashboard "last 3 days", the activity timeline and the generated-report journal now aggregate across every storage partition (day/week/month), skipping dotfolders (.trash/.git/.obsidian). Editable views and counts stay scoped to the current partition to avoid ID collisions.
• Add last-7 / last-30 report periods.

Accessibility & UI

• Nav items are real <button> elements with aria-current and aria-hidden icons; focus-visible outline + button reset.
• Fix double-escaping of markdown list items.
• Sandbox the report preview iframe and give it a title.
• Config modal requires a preview before apply and surfaces skipped items / destination conflicts.
• Responsive top nav (horizontal scroll) instead of hiding the sidebar; table row actions reveal on focus-within.

Validation

Ran against the live canvas: loopback requests → 200; spoofed Host, cross-site Sec-Fetch-Site, and non-loopback Origin → 403; last-7 report generates; table cells round-trip pipes and newlines; migration plan enumerates every partition on a root change.