fix(jarvis-web): router-navigate docs button (#477) + gate Tab-to-cycle on empty composer (#478)

[TYRMars]

Auto-resolves two open jarvis-web bug reports. Both target real code in the current tree; each fix is minimal and follows patterns already established elsewhere in the SPA.

#477 — docs button does a hard document navigation

apps/jarvis-web/src/components/AppChatPane.tsx — the "open docs" composer button used window.location.href = "/docs", a full-document navigation inside a react-router SPA.

• Browser mode: the assignment tore down the app — chat WebSocket, in-flight stream, composer value, and staged attachments all lost for what should be a client-side route change.
• Desktop mode (HashRouter): routes live in the hash, so a hash-less /docs reload rendered / (the chat surface) instead of docs; before the sidecar was healthy the window was on file://, where /docs resolved to a dead file:///docs page.

Fix: call useNavigate()("/docs"), matching the rest of the app's navigation. There is already a /docs route in App.tsx, and useNavigate is used across the SPA (DocsPage, ProjectsPage, AppSidebar, …).

#478 — bare Tab cycles permission mode regardless of composer content

apps/jarvis-web/src/components/Composer/Composer.tsx — the onKeyDown Tab branch preventDefault()'d and called cyclePermissionMode() whenever the slash palette was closed and no modifier was held, never checking that the textarea was empty (which the handler's own comment claims it does).

• Silent permission-mode changes mid-typing: a user pressing Tab after typing a prompt flipped the permission mode (and could pop the bypass window.confirm).
• One-way focus trap: preventDefault() ran before cyclePermissionMode()'s if (!isOpen()) return early-out, so forward Tab never moved focus even when nothing else happened.

Fix: add the value.length === 0 guard to the Tab branch, matching the adjacent Backspace branch that already gates on empty content. Non-empty Tab now falls through to normal browser focus traversal / indent.

Notes

• Sibling issue jarvis-web (node) DesktopStartupOverlay.onConfigureProvider: writes the settings target then assigns an identical hash → click is a no-op while already on Settings, and the orphaned sessionStorage key hijacks the next Settings visit #479 (DesktopStartupOverlay.onConfigureProvider / SETTINGS_TARGET_KEY) references code that does not exist in this branch's DesktopStartupOverlay.tsx, so it is not addressed here.
• Not typechecked in-session: the standalone web app has no installed node_modules here, and the sandbox's newer npx tsc errors on a pre-existing baseUrl tsconfig deprecation unrelated to this diff. The changes are small and use existing, widely-used APIs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ltebc8xx243roKDvh9Dy9X

---

Generated by Claude Code