Add file-based comment persistence with .review.json

[dfpersonal]

Summary

• Save/load review comments to .review.json files on disk alongside the source markdown, replacing browser localStorage for persistence
• Comments now survive browser restarts, can be shared, and reload automatically when a file is reopened
• Adds GET/PUT/DELETE /api/reviews endpoints with atomic writes (write to .tmp, then rename)
• Adds useReviewFile hook with debounced auto-save (1s) and immediate flush on unmount
• Adds a Save button in the comment sidebar for explicit saves, with saving/saved status indicator
• One-time migration from localStorage on first load (existing comments are preserved)
• Deleting all comments automatically removes the .review.json file
• Chokidar ignore pattern updated so review file writes don't trigger SSE reload events
• Refactors path traversal check into shared resolveSecurePath() helper

Files changed

File	Change
server/index.js	Review API endpoints, security helper, chokidar ignore
src/hooks/useReviewFile.ts	New — load/save/debounce hook
src/components/DevModeApp.tsx	Replace useLocalStorage with useReviewFile
src/components/CliModeApp.tsx	Replace useState with useReviewFile
src/components/CommentList.tsx	Save button and status indicator
src/components/MarkdownPreview.tsx	Pass through saving/onSaveNow props
src/styles/markdown.css	Save button styles and spin animation
.gitignore	Ignore *.review.json files

AI disclosure

This code was written by Claude (Anthropic's AI assistant) using Claude Code. The commit is co-authored accordingly. I'm submitting this because I find the tool genuinely useful and wanted file-based persistence — but I want to be upfront that I directed the work rather than writing the code by hand.

Test plan

• pnpm test — all 37 existing tests pass
• pnpm build — builds cleanly
• CLI mode: md-review some-file.md — comments save to .review.json, reload on refresh
• Directory mode: md-review docs/ — comments persist per file
• Deleting all comments removes the .review.json file
• Review file writes don't trigger SSE reload events