Fix P0 issues: Windows SDK patch, WS auth hardening, approval diffs, read gating - #8

Summary

• Windows install: scripts/patch-sdk.mjs compared import.meta.url to file://${argv[1]}, which never matches on Windows, so postinstall silently skipped the SDK patch and the first chat threw "not patched". It now compares paths.
• WebSocket auth: the server refuses to start the real agent without FREEBUFF_REMOTE_TOKEN (an empty token used to disable auth). WebSocket handshakes with a browser Origin that doesn't match Host are rejected, so another web page can't drive the local server. Messages are capped at 1 MB.
• Approvals show the real change: write_file computes the diff against the file on disk before asking, so full-file writes show a diff on the phone, not just patches. Patches that can't apply are rejected without prompting.
• Read gating: a new read_files override stays inside the project and asks before credential-like files (.env*, *.pem, *.key). The sensitive-path regex now handles Windows separators.

Known limits

• The read_files override replaces the SDK's reader, so reads no longer honor .gitignore.
• code_search, glob and list_directory are still ungated.
• The client approval card change (renders unifiedDiff) has not been checked in a browser.

Test plan

• tsc --noEmit clean
• 10 new tests (patch-sdk, token required, Origin check, diff in approval, unappliable patch, read gating, Windows path matching)
• Full suite on Windows: 56 pass; the 8 failures are pre-existing Windows-only test issues (bash installer tests, POSIX file mode, hard-coded /tmp)
• Run on macOS/Linux
• Manually approve a file write from the phone UI