Replace hardcoded filesystem whitelist with project-derived dynamic whitelist (INV-10)

[rororowyourboat]

Context

From the system design audit, the canvas filesystem access whitelist is hardcoded in electron/ipc.ts as ALLOWED_FILE_ROOTS. This is fragile — adding new projects requires code changes.

Current State

// electron/ipc.ts
const ALLOWED_FILE_ROOTS = [
  '/home/rohan/Documents/Github/personal/t3_canvas/t3-canvas',
  '/home/rohan/Documents/Github/personal',
  '/home/rohan/Pictures',
  '/home/rohan/Documents',
];

Design Decision (from spec)

INV-10: Filesystem access restricted to the union of all active project workspaceRoot paths, with symlinks resolved to canonical paths.

The whitelist should be dynamically derived from active projects. PLAN.md Phase 5 already targets this.

Proposed Changes

1. Canvas main process queries the t3code server for active project roots on startup (or reads from a shared config file)
2. Whitelist = union of all active project workspaceRoot values
3. Resolve symlinks to canonical paths via fs.realpath() before comparison
4. Worktree paths (which are within workspace root by git convention) are automatically covered
5. Whitelist refreshes when projects are added/removed

Acceptance Criteria

• No hardcoded paths in ALLOWED_FILE_ROOTS
• Whitelist derived from active project roots
• Symlinks resolved before path comparison
• Adding a new project automatically extends file access
• Removing/deleting a project shrinks file access

References

• System Design Spec: .plans/21-system-design-spec.md Section 2 (INV-10), Section 9
• Audit finding: "Security whitelist model is fragile and static"
• PLAN.md: Phase 5 target