feat(viewer): order session stream by newest or oldest first - #271

Summary

Oldest / Newest toggle in the session header, so the latest post can come first. Posts stay stored in createdAt order; Newest only reverses the stream rendering. No server, wire, or store changes.

 <SessionView> (viewer/src/App.tsx)
   <div.session-head>
     <SessionTitle>
+    <OrderToggle>          # stream view only; postOrder() persisted in localStorage
     <ViewToggle>
   <div#stream>
-    <For each={posts}>
+    <For each={newestOnTop() ? [...posts].reverse() : posts}>
       <Card>

Auto-follow and the new-post pill follow the edge where new posts land:

 upsertPost(new post)
-  if nearBottom()          scroll to it
+  if nearNewest()          scroll to it    # top when newestOnTop(), else bottom
   else                     show pill
-                           "new post ↓"
+                           newestOnTop() ? "new post ↑" : "new post ↓"

Timeline view is untouched: it is chronological by design (trace steps interleave by time) and the toggle hides there.

Evidence

New spec e2e/viewer.spec.ts › "the stream can order posts newest first, and remembers it":

publish First, Second
expect stream  [First, Second]
click "Newest"
expect stream  [Second, First]
publish Third (live)
expect stream  [Third, Second, First]
reload
expect stream  [Third, Second, First]

• Before (main): posts oldest-first only, no order toggle.
  
  After, "Newest" selected: latest post on top.
  

• Before (viewer from main): new spec ✘ locator.click: Test timeout of 30000ms exceeded, no "Newest" button.
  After: ✓ 1 passed.

Full suites: npm test, npm run coverage, npm run test:worker, npm run typecheck, npm run lint, npm run test:e2e -- --project=chromium (92 passed). WebKit not run locally (missing host libraries). npm run security:audit fails on existing dependency advisories (e.g. zod); this PR doesn't touch dependencies.

Merge Danger

Door: two-way

Viewer-only. Default stays "Oldest", so behaviour is unchanged until someone opts in. Revert drops the toggle; a leftover sideshow-post-order localStorage key is harmless.

Blast Radius: viewer-header

The session header gains a second .view-toggle group. Selectors that assume one .view-toggle will match two: e2e/embed-slots.spec.ts now targets the View mode group by role, and embedders styling or querying .view-toggle should check theirs. Adds width to the header on narrow screens.