Phase 1: file-api service for VM filesystem persistence (#3)

Adds packages/file-api — a Fastify HTTP service that exposes a small
file API rooted at $BRAIN_DIR (default /brain). Phase 1 of the plan
to move BizerOS Knowledge off browser IndexedDB and onto markdown
files persisted on the VM.

Endpoints:
- GET    /api/health
- GET    /api/tree            — flat listing of files and dirs
- GET    /api/file?path=...   — read; returns body + x-mtime, x-size
- PUT    /api/file?path=...   — atomic write (tmp + rename), mkdir -p
- DELETE /api/file?path=...
- POST   /api/move            — { from, to }
- GET    /api/watch           — Server-Sent Events FS change stream

Safety:
- resolveSafe() rejects null bytes, traversal (../), and any path
  whose resolved absolute escapes brainDir.
- Extension allowlist (.md/.edn/.json/.txt/.org/.png/.jpg/.jpeg/.gif
  /.webp/.svg/.pdf), case-insensitive, configurable via env.
- 25 MB default body cap.
- Binds 127.0.0.1 by default — meant to live behind nginx in the
  same container, not exposed directly.

Tests use node:test + fastify.inject() — 20 cases covering happy
paths, traversal/extension rejection, mkdir-p, move, delete-missing.

Co-authored-by: Claude <noreply@anthropic.com>

Author: kelsi-bizer

packages/file-api/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@bizeros/file-api",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "packageManager": "pnpm@10.33.0",
+  "main": "src/server.js",
+  "scripts": {
+    "start": "node src/server.js",
+    "test": "node --test test/*.test.js"
+  },
+  "dependencies": {
+    "fastify": "5.8.2",
+    "chokidar": "4.0.3"
+  }
+}