ux(canvas/files): right-click context menu — Open / Download / Delete (#2999 PR-C)

[HongmingWang-Rabbit]

Why

User asked for a VSCode-style right-click menu on file rows (#2999): "right click to have a menu to download". Today the only download affordance is the toolbar's Export-all (bulk JSON dump), and the inline ✕ button is the only delete UX (small click target, easy to miss).

Fix

1. New FileTreeContextMenu component — fixed-position popover with Open / Download / Delete items composed per-row (files get all three; directories get Delete only since "open a directory in the editor" doesn't apply). Esc + outside-click + Tab + scroll dismiss. ↓/↑ arrow keys rove focus between menu items. role=menu + role=menuitem + autofocus on first item for a11y.
2. Menu state lifted to the top-level FileTree (not per-row) so opening a second row's menu auto-closes the first — only one menu open at a time, matching VSCode/Theia. Pinned by the "replaces the first" test.
3. New downloadFileByPath(path) in useFilesApi — fetches via the existing GET /workspaces/<id>/files/<path>?root= endpoint and triggers a browser download. Distinct from the existing handleDownloadFile which downloads the in-editor buffer (round-trips unsaved edits to disk); the context-menu download targets arbitrary tree rows the user hasn't opened.
4. canDelete prop threaded from FilesTab → FileTree → menu → item. Same gate as the toolbar (Clear/New/Upload all gated to /configs); context menu's Delete renders as disabled with a muted background on other roots.

Test coverage

FileTreeContextMenu.test.tsx (8 tests):

• File row → menu opens with Open + Download + Delete.
• Directory row → menu opens with Delete only.
• Click Download → onDownload(path) fires + menu closes.
• Click Delete (canDelete=true) → onDelete(path) fires.
• Click Delete (canDelete=false) → onDelete NOT called + menu stays open (disabled-state UX).
• Esc dismisses.
• Outside-click (mousedown on document.body) dismisses.
• Opening second context menu replaces the first (only-one-open invariant).

Three weakest spots (hostile self-review)

1. Menu positioned at clientX/clientY without viewport clamping. Right-click at the very bottom-right may overflow a few pixels. FilesTab is fixed-width and the menu is small (~140×80px), so overflow is bounded. Filed as a follow-up.
2. Auto-focus on first item shifts keyboard focus away from the row. Closing with Esc returns focus to the body, not the row. Matches the canvas's other context menus — uniform if not ideal.
3. Download request reuses the API client's 15s default timeout. Same risk as the existing toolbar Export.

Verification

• npx tsc --noEmit clean
• 176/176 canvas tab tests pass
• Manual on local dev: right-click a config.yaml row → menu opens → click Download → file lands in Downloads. Right-click on /home root → Delete renders disabled.

Pairing

Pairs with PR #3002 (PR-A, backend EIC) — without PR-A the tree is empty and there's nothing to right-click on a SaaS workspace.

Refs #2999.

🤖 Generated with Claude Code