Add out-of-band branch timeline manager

[adamziel]

What it does

Adds an out-of-band ForkPress branch manager at /_forkpress/branches. It renders branch history as a git-style timeline with separate lanes, visible fork points from setup metadata, merge arcs back into target branches, and conflict markers that open the conflict review flow.

It also keeps the existing WordPress admin page as a pointer into the out-of-band manager instead of trying to host the full workflow inside wp-admin.

Rationale

The in-admin branch widget is too small for history review, conflict inspection, and branch switching. The earlier flat graph also hid the important relationship: setup runs are branch -> branch, but users expect to see them as branch-off points in a timeline.

Implementation

runtime/cow/router.php now serves the manager directly before WordPress boots. The graph loads forkpress branch tree --format json, infers branch fork parents from setup and merge runs, draws finite lanes, and annotates conflicted runs by loading conflict audit summaries.

Conflict review now displays decoded base/source/target/current values, editable review notes, and selected resolution actions instead of forcing users to read raw JSON. The WordPress plugin and router both accept those notes and pass them through to merge-review / merge-resolve.

Testing instructions

Focused checks run locally:

php -l runtime/cow/router.php
php -l wp-plugin/forkpress-wp.php
php -l tests/cow/router_lock.php
php -l tests/cow/branch_ui.php
node --check /tmp/forkpress-branch-manager.js
php tests/cow/router_lock.php
php tests/cow/branch_ui.php
git diff --check

Live preview used for visual verification:

https://forkpress.ai-sandbox-49184.kostka.zielinscy.dev/_forkpress/branches?graph=timeline-git-v2

[adamziel]

Follow-up fix for the empty chart preview:

• The manager was injecting http://.../_forkpress/action as an absolute JSON endpoint. That worked in a local http://...:8080 screenshot, but can be blocked as mixed content when the preview page is opened through HTTPS.
• actionUrl and rootUrl are now same-origin relative paths.
• Branch/admin URL generation now honors X-Forwarded-Proto / proxy HTTPS headers.
• Added regression coverage in tests/cow/router_lock.php and tests/cow/branch_ui.php.

Verified again with php tests/cow/router_lock.php, php tests/cow/branch_ui.php, syntax checks, JS syntax check, and a fresh Chromium screenshot against the patched live preview.