feat: 项目 logo + 侧栏拖动排序 + 合并修复(主检出干净时 in-place)

- 项目 logo：仓库内文件(logo/icon/favicon 等多路径)→git remote 头像→自定义(URL/相对路径)→
  首字母徽章兜底；GET /api/projects/:id/logo(文件流/302)，配置面板加 Logo 输入
- 侧栏项目拖动排序：projects.sort_order + POST /api/projects/reorder，乐观更新
- 合并修复：默认分支正被主检出占用时，若工作区干净则直接在主检出 in-place 合并
  (用户手动合并的等价操作，安全)；脏工作区拒绝并提示提交/暂存或仅通过
- schema: projects.logo / sort_order(ensureColumn 平滑迁移)

测试 75/75(merge 用例改为干净→成功/脏→拒绝)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/api/server.ts

@@ -9,6 +9,8 @@ import { syncProject, hasTodoJson } from '../sync/todo-sync.js';
 import { resolvedExecutorModels } from '../executor/models.js';
 import { mergeBranch } from '../executor/merge.js';
 import { git, removeWorktree } from '../executor/worktree.js';
+import { resolveLogo, LOGO_MIME } from './logo.js';
+import { createReadStream } from 'node:fs';
 import { createUsageFetcher, type UsageInfo } from '../daemon/usage.js';
 
 /** Project 出参：附加 hasTodoJson（<repoPath>/todo/todo.json 是否存在，每次序列化时算） */
@@ -70,9 +72,30 @@ export function buildServer(opts: ApiOptions): FastifyInstance {
     if (b.status !== undefined) patch.status = b.status as 'active' | 'paused';
     if (b.verifyCmd !== undefined) patch.verifyCmd = b.verifyCmd === null ? null : String(b.verifyCmd);
     if (b.model !== undefined) patch.model = b.model === null ? null : String(b.model);
+    if (b.logo !== undefined) patch.logo = b.logo === null || b.logo === '' ? null : String(b.logo);
     return projectOut(store.patchProject(id, patch));
   });
 
+  // 项目重排序（侧栏拖动）：body { order: [projectId, ...] }
+  app.post('/api/projects/reorder', (req) => {
+    const b = (req.body ?? {}) as { order?: unknown };
+    if (!Array.isArray(b.order)) throw new StoreError('order 必须是项目 id 数组');
+    return store.reorderProjects(b.order.map(String)).map(projectOut);
+  });
+
+  // 项目 logo：仓库内文件 → 流式返回；外链头像 → 302；无 → 404（前端用首字母徽章兜底）
+  app.get('/api/projects/:id/logo', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    const p = store.getProject(id);
+    if (!p) return reply.code(404).send();
+    const r = await resolveLogo(p);
+    if (!r) return reply.code(404).send();
+    if (r.type === 'redirect') return reply.redirect(r.url);
+    const ext = r.path.split('.').pop()?.toLowerCase() ?? '';
+    reply.header('cache-control', 'no-cache').type(LOGO_MIME[ext] ?? 'application/octet-stream');
+    return reply.send(createReadStream(r.path));
+  });
+
   // 单向同步 <repoPath>/todo/todo.json → maestro（导入=首次同步，幂等）
   app.post('/api/projects/:id/sync', (req) => {
     const { id } = req.params as { id: string };