fix(files): heal legacy media URLs and deduplicate file references

SignFileURLs now heals legacy session data at delivery time:
- Dedup double /v1/files/v1/files/ prefix from old mutation bug
- Strip stale ?ft= from markdown link display text
- Re-sign all URLs with fresh tokens (never skip)

File serving: use workspace root for ft= auth fallback search
(no tenant context available with signed tokens).

Deduplicate ContentSuffix media by basename to prevent duplicate
file links when agent text already references the same file.
Frontend dedup as defense-in-depth for legacy data.

internal/agent/loop_finalize.go

@@ -48,8 +48,9 @@ func (l *Loop) finalizeRun(
 	}
 
 	// Append content suffix (e.g. image markdown for WS) before saving to session.
-	if req.ContentSuffix != "" && !strings.Contains(rs.finalContent, req.ContentSuffix) {
-		rs.finalContent += req.ContentSuffix
+	// Dedup by basename: skip suffix lines whose file already appears in the agent's text.
+	if req.ContentSuffix != "" {
+		rs.finalContent += deduplicateMediaSuffix(rs.finalContent, req.ContentSuffix)
 	}
 
 	// Collect forwarded media + dedup + populate sizes BEFORE saving to session,