The renderer half of #1. Four additions, matching the core contract in
OpsDeck/core#35 — the app is the whole module on a phone, so what the schema
cannot say here, a phone cannot do.

**Typed-phrase confirm.** `confirmPhrase` puts a field in the dialog and keeps
the confirming button dead until it matches. The phrase interpolates route
params, so a module can ask for the thing's own name. This is the parity that
prompted the issue: the same recursive delete was one tap here and a typed
phrase on the web, on the device where a tap is more reflexive, not less.

**Downloads, and not through DownloadManager.** The obvious implementation
does not work: DownloadManager fetches from the system's downloads process,
which does not inherit this app's cleartext allowance, so a self-hosted server
on plain HTTP fails with "Download unsuccessful" and no reason — verified on a
device before rewriting it. Fetching through our own OkHttp client keeps the
session cookie, the cleartext policy and the error message where they already
work, and gives real progress instead of a notification we cannot see inside.
The file lands in the public Downloads collection through MediaStore (no
permission, and where a person looks for it), named from the response's
content-disposition — the route addresses a file by an opaque param, so the
header is the only place its real name exists. A failed transfer deletes its
pending MediaStore row rather than leaving an invisible stub.

**Uploads.** A `file` field opens the document picker and the form submits as
multipart: text parts for the ordinary fields, one part per file, streamed
from the content URI straight into the socket so a large video costs 8 KB of
heap rather than a second copy on disk. Progress is counted in the sink, which
is bytes actually handed to the connection.

**A way up.** A page carrying `parent` renders an up affordance. Distinct from
the back arrow, which unwinds however you arrived — a notification or a deep
link has no history to unwind, and the parent is still the parent.

Verified against a real server on an API 36 emulator, all four end to end:
the delete dialog refused an empty phrase and deleted once "scratch" was
typed; README.txt came down byte-exact (299 of 299) and was saved under its
real name; the same file went back up through the picker and landed 299 bytes
on the server; and "All roots" navigates from a directory page to the root.

One Kotlin trap worth the comment it got: a KDoc containing a MIME glob opens
a nested block comment and silently eats the rest of the class.

@@ -270,0 +294,4 @@
+    @SerialName("open")
+    val openUrl: String? = null,
+    /** `open` saves the bytes rather than viewing them */
+    val download: Boolean = false,

@@ -115,0 +181,4 @@
+                // the route addresses a file by an opaque param, so the only
+                // place its real name exists is the disposition header
+                res.header("content-disposition")
+                    ?.let { Regex("""filename\*?=\"?([^\";]+)""").find(it) }

@@ -197,0 +211,4 @@
+                "file" -> {
+                    val chosen = picked[field.key].orEmpty()
+                    val launcher = rememberLauncherForActivityResult(
+                        ActivityResultContracts.OpenDocument(),

@@ -428,0 +490,4 @@
+            val outcome = runCatching {
+                withContext(Dispatchers.IO) {
+                val values = ContentValues().apply {
+                    put(MediaStore.Downloads.DISPLAY_NAME, name)

@@ -428,0 +494,4 @@
+                    put(MediaStore.Downloads.IS_PENDING, 1)
+                }
+                val uri = resolver.insert(
+                    MediaStore.Downloads.EXTERNAL_CONTENT_URI,

@@ -428,0 +503,4 @@
+                        path,
+                        onProgress = { got, total ->
+                            val pct = if (total > 0) ((got * 100) / total).toInt() else null
+                            _state.value = _state.value.copy(transferPercent = pct)

@@ -0,0 +67,4 @@
+            i += 1
+        }
+    }
+    return out.toString(Charsets.UTF_8.name())

@@ -197,0 +249,4 @@
+                            val types = field.accept
+                                ?.split(",")
+                                ?.map { it.trim() }
+                                ?.filter { it.isNotEmpty() && !it.startsWith(".") }

@@ -428,0 +494,4 @@
+    fun openAction(action: UiAction) {
+        val client = container.clientOrNull ?: return
+        val path = interpolate(action.openUrl ?: return, _state.value.params, encode = true)
+        val fallbackName = fileNameOf(path)

@@ -428,0 +617,4 @@
+                temp.sink().buffer().use { sink -> sink.writeAll(source) }
+            }
+            if (code >= 400) error(detail?.ifBlank { null } ?: "HTTP $code")
+            val target = File(dir, name)

@@ -428,0 +642,4 @@
+
+    private fun view(app: Application, saved: Saved) {
+        val intent = Intent(Intent.ACTION_VIEW).apply {
+            setDataAndType(saved.uri, saved.mime ?: "*/*")