files: PDFs, text, code, tables and certificates open in place

The file pane decided what to show by MIME type, and uploads keep a
type only when it cannot execute, so a .md, a .json or a .pem arrived
as application/octet-stream and got "no preview". It now goes by name
first (preview.ts), and a file with a name it does not know has its
first 8 KiB looked at: no NUL bytes and valid UTF-8 means text.

- text and code: the first 256 KiB with line numbers, as before
- markdown: rendered through the same sanitiser as documents, with a
  source toggle
- CSV/TSV: a table of the first 500 rows, quotes respected
- PDF: the browser's own viewer in a frame. Only a PDF is served
  without the sandbox CSP (Chrome's viewer will not start under it),
  with frame-ancestors 'self' and X-Frame-Options SAMEORIGIN; the app
  CSP allows same-origin frames.
- certificates, keys, keystores: POST /api/nodes/{id}/inspect reads
  PEM (chains, keys, requests, public keys), DER and PKCS#12 on the
  server, in pure Rust, including the RC2/3DES keystores that
  openssl -legacy and older keychains write. It answers with subject,
  issuer, validity, key, names, usage and fingerprints, and pairs each
  private key with its certificate by public key. A password is asked
  for only when needed, used for that one answer and never stored;
  no key material is ever sent back. Sealed files are read through the
  vault, and only while it is open.

The tests read throwaway fixtures under src/routes/testdata, made with
the openssl commands listed beside them; .gitignore lets their .pem
files past a global *.pem rule.

README.md

@@ -11,7 +11,8 @@ one binary. It was called `narl-diary` until it grew everything but the diary.
 - A kanban board per space, so what is open at work is not mixed up with uni.
 - Drag, drop or paste images, video and audio straight into an entry.
 - Files of any kind — PDFs, archives, recordings — live in the tree beside the
-  notes about them, streamed to disk however large.
+  notes about them, streamed to disk however large — and PDFs, text, code,
+  tables and certificates open in place.
 - Share any document behind an unguessable link — revocable at any time.
 - A vault: files sealed with AES-256-GCM under a password that is never stored,
   readable only while it is unlocked.
@@ -237,8 +238,23 @@ the tree is never one of them: it is deleted from its folder, not from
 ## Files
 
 A file is a node like a document, only with bytes instead of text: it sits in
-a folder, shows its size in the list, and `Enter` opens it — images, video,
-audio and plain text are shown in place, anything else is a download. `:name`
+a folder, shows its size in the list, and `Enter` opens it. What is shown in
+place:
+
+- images, video and audio;
+- PDFs, in the browser's own viewer;
+- text and source code of any kind, recognised by its name or, failing that, by
+  its first few kilobytes, with line numbers and the first 256 KiB of it;
+- markdown, rendered, with `source` to see it as written;
+- CSV and TSV, as a table of the first 500 rows;
+- certificates, keys and keystores — `.pem`, `.crt`, `.cer`, `.der`, `.csr`,
+  `.key`, `.p8`, `.p12`, `.pfx` — read on the server: subject, issuer,
+  validity, key, names, usage and fingerprints, and which key belongs to which
+  certificate. A `.p12` or an encrypted key asks for its password, which opens
+  it for that one look and is never stored. Nothing of a private key is ever
+  sent back but its algorithm and size.
+
+Anything else is a download. `:name`
 renames it, and the download is called whatever it is called now; `:mv`, `m`
 and `p` move it; `x` deletes it. `:upload` picks files for the folder being
 browsed, or drop them onto the list. Each upload is written to disk as it
@@ -532,6 +548,7 @@ sealed or not.
 | `GET`/`DELETE` | `/api/media/{id}` | serve (with `Range`) / delete a file nothing in the tree owns |
 | `GET` | `/api/spaces/overview` | every space with what was last written in it |
 | `POST` | `/api/nodes/{id}/files` | upload files into this folder as file nodes (`?encrypt=true` seals them) |
+| `POST` | `/api/nodes/{id}/inspect` | what a certificate, key or keystore file holds (`{password}` opens a protected one) |
 | `POST` | `/api/nodes/{id}/encrypt`, `/decrypt` | seal a file, or every file under a folder, or take it out |
 | `GET`/`POST`/`PUT` | `/api/vault` | status / set the password once / change it |
 | `POST` | `/api/vault/unlock`, `/api/vault/lock` | open / close the vault |