feat: add remote.projectRoots widening and GET /api/fs/list for browse-and-create

[william0wang]

What

Powers the mobile app's browse-and-create flow (bridge ≥0.65):

• GET /api/fs/list?path=<abs> — one directory level of the hub machine's
  filesystem (subdirs only, 2000 cap, realpath answers, creatable flag).
• remote.projectRoots (~/.config/zcode-acp/config.json, live-read;
  env fallback ZCODE_ACP_PROJECT_ROOTS path-list) — widens the
  POST /api/instances whitelist beyond the known-project list to any
  existing subdirectory under a configured root.

Unconfigured, the known list alone stays the whitelist and every directory
still browses (creatable true only on known projects).

Verification

• pnpm typecheck, pnpm lint, prettier, pnpm build clean
• full suite 142 files / 2099 tests green
• live hub smoke after rebuild: /api/fs/list answers 200 with auth,
  401 without, creatable:false on an unconfigured machine