feat(overleaf): add manual bidirectional sync

[YishayPo]

What changed

• Adds manual bidirectional Overleaf synchronization through a private Git mirror under the server state directory.
• Supports workspace-root or subdirectory mappings, saved host-scoped accounts, connection preflight, safe initial reconciliation, push-before-project sync, outbound deletion/revert review, whole-file conflict resolution, local reconciliation, repair, and disconnect.
• Adds an isolated direct Git executor with clean environment construction, operation-scoped askpass credentials, bounded output/timeouts, and process-tree cleanup.
• Discovers the project's advertised main or legacy master branch instead of assuming one fixed branch.
• Adds typed HTTP/client contracts, Project Settings and LaTeX toolbar surfaces, user/internal documentation, focused tests, and a guarded five-mount upstream seam manifest.
• Adds a streamlined project-level onboarding entry beside Sources/Zotero: connect an account once, open the signed-in Overleaf project list, explicitly paste the chosen project link, choose a project folder or workspace root, and connect with automatic Safe Combine when no review is required.
• Keeps account host, commit policy, and replacement modes under Advanced while showing account/project failures persistently inside the relevant dialog.

Why

Using the workspace repository would couple Overleaf synchronization to inherited checkpoint Git indexes, while a nested repository would make checkpoint capture treat the paper as a gitlink. A private mirror keeps Git state app-owned, preserves checkpoint coverage of ordinary workspace files, and minimizes inherited T3 mount conflicts.

Synchronization is manual-only and pushes before workspace projection so remote races do not mutate local files and confirmed pushes can recover projection offline.

Overleaf does not expose a supported account project-list API. The onboarding therefore opens the normal signed-in Overleaf dashboard and reads the clipboard only after an explicit Paste action; it does not scrape private endpoints or introduce another browser login.

Impact

• No automatic polling, save/open hooks, or background Overleaf network activity.
• No .git directory is placed in the workspace.
• Git author and committer metadata comes only from the configured human Overleaf identity.
• Deletions and historical reverts require candidate-bound confirmation; conflicts remain in the mirror until resolved.
• Tokens remain write-only through the API and use the existing private-file secret store.
• Routine warning-free setup is a single Connect action after the project and destination are chosen.

Validation

• Focused Overleaf onboarding/validation tests: 6 passed.
• Web typecheck and scoped lint/format passed.
• Production web build passed (7,209 modules).
• Overleaf seam verifier passed: 5/8 inherited mounts and 2 declared cross-Scient mounts.
• git diff --check passed.
• GitHub CI is green across Check, Documentation, provenance, Web, Workspace, all Server shards, mobile static analysis, and release smoke.
• Windows x64 NSIS packaging completed and validated an 89-file payload with 38 sidecar natives.
• A real authenticated read-only Cloud Git Bridge probe succeeded and confirmed an advertised main branch.

Draft acceptance gates

• Run the disposable Cloud and Server Pro Git Bridge commit/tree-identity spike with real disposable projects.
• Exercise packaged Desktop askpass/process-tree behavior through a full connect and Sync against a disposable project.
• Capture required before/after UI evidence after explicit approval for browser/computer interaction.