fix: file-link and session-sidebar review follow-ups from 1.19.0

Five post-merge review items from PRs #306 (clickable file paths) and
#307 (session sidebar):

- constants.js FILE_PREVIEW_EXTENSIONS gains the media extensions it was
  missing vs the single-source sets in attachment-registry.ts (m4v ogv
  ogg oga m4a aac flac opus), so an in-workspace .m4a opens the preview
  player instead of the log viewer; new test/media-extension-parity.test.ts
  pins all three copies (constants.js, panels-ui.js, attachment-registry.ts)
  against each other.
- FILE_PATH_LINK_PATTERN drops `etc` from its root alternation: /etc is
  unconditionally in DEFAULT_BLOCKED_TREES, so every /etc link 403'd.
  Negative cases added to the link-provider and response-viewer tests.
- updateSidebarCount() counts the rows actually on the sidebar list
  (session rows + web-tab rows, minus filtered-out ones) instead of
  this.sessions.size, and applySidebarFilter() refreshes it so the count
  follows the filter box per keystroke.
- The incremental-render connection-line gate now also fires in sidebar
  layout (this._lineageEdgeCount is permanently 0 there), matching the
  strip-scroll listener widened in #307, so a badge changing row heights
  redraws subagent/ultracode connectors.
- isSensitivePath() blocks ~/.claude.json, ~/.claude/settings.json and
  ~/.claude/settings.local.json (credential-bearing by schema), anchored
  to homedir() read at check time so case-level .claude/settings*.json
  files stay servable in the File Viewer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/session-list-layout.test.ts

@@ -394,15 +394,32 @@ describe('session list layout', () => {
     expect((drawer.win.document.activeElement as HTMLElement).className).toContain('session-tab');
   });
 
-  it('shows the live session count in the sidebar header', () => {
+  it('counts the rows actually on the list: web tabs included, filtered rows excluded', () => {
+    // this.sessions.size was the original source and disagreed with the screen
+    // twice over: web tabs render in the same list but are not sessions (3
+    // sessions + 2 dashboards read "3" above 5 rows), and the filter hides
+    // rows without touching the map.
     const { win, app } = boot({ stored: { sessionListLayout: 'sidebar' } });
     app.sessions = new Map([
       ['a', {}],
       ['b', {}],
-      ['c', {}],
     ]);
     app.applySessionListLayout();
-    expect(win.document.getElementById('sessionSidebarCount')?.textContent).toBe('3');
+    tabsEl(win).innerHTML = `
+      <div class="session-tab" data-id="a" aria-label="api server" title="/srv/api"></div>
+      <div class="session-tab" data-id="b" aria-label="docs" title="/home/docs"></div>
+      <div class="session-tab session-tab--web" data-webview-id="w" aria-label="Grafana web tab" title="http://x/g"></div>
+    `;
+    app.updateSidebarCount();
+    const count = () => win.document.getElementById('sessionSidebarCount')?.textContent;
+    expect(count()).toBe('3');
+
+    // The count follows the filter — applySidebarFilter is what the filter box
+    // calls per keystroke, so it must move without waiting for a re-render.
+    app.applySidebarFilter('api');
+    expect(count()).toBe('1');
+    app.applySidebarFilter('');
+    expect(count()).toBe('3');
   });
 
   it('forces tall rows and no wrapping in the sidebar, and leaves the strip rules alone', () => {