Browser local servers: hide unwanted entries and discover project systemd/cwd listeners #9

Problem

The browser panel's Local servers list shows servers I don't need, and misses ones I do.

• Noise: each agent session starts its own Serena dashboard. On 2026-10-05 this machine had 23 Serena listeners (127.0.0.1:24282–24304). Agents started them inside T3 sessions, so they count as T3-owned and pass the HTML probe, and they crowd the list.
• Missing: a long-running user systemd service on a port outside the fixed list never appears. The concrete case is the Amine-Thermodynamics analyses preview: cse-preview-Amine-Thermodynamics-daf39727.service, serving 127.0.0.1:8770 with working directory …/Engineering/Amine-Thermodynamics/analyses, inside the project root. It is the most useful server for that project, yet I had to add a dummy project script with previewUrl just to make it show up.

Current behaviour

apps/server/src/preview/PortScanner.ts (at 31a0fb3a42) probes only:

1. T3-owned listeners, meaning terminal and process descendants;
2. COMMON_DEV_PORTS (3000, 3001, 3333, 4173, 4200, 4321, 5000, 5173–5175, 5500, 8000, 8080, 8081, 8888, 9000);
3. configured URLs, which come only from project scripts' previewUrl (getConfiguredPreviewUrls in apps/web/src/components/preview/previewEmptyStateLogic.ts).

There's no way to hide an entry, and no discovery of listeners outside these three sources.

Wanted

1. Hide unwanted servers, persistently. Hide one entry from the list, plus a rule that covers a whole family, for example by process name (serena) or by port range. Hidden entries are restorable from settings and don't come back on each scan.
2. Find project-relevant servers that T3 didn't start. The lsof output already gives each listener's process ID. Also consider loopback listeners whose process either runs in a user systemd unit (/proc/<pid>/cgroup → …/app.slice/<unit>.service) or has a working directory (/proc/<pid>/cwd) inside a registered project's workspace root. These still pass through the existing bounded HTML probe and its cache.
3. Show why each server is listed, and rank by relevance. Label each entry with its source (T3-started, project directory, systemd unit name, common port, configured), and list the active project's servers first.

Acceptance examples (this machine)

• With a serena hide rule, none of the 23 Serena dashboards appear. Removing the rule brings them back.
• In the Amine-Thermodynamics project, 127.0.0.1:8770 appears without any project script, labelled with its unit cse-preview-Amine-Thermodynamics-daf39727.service, ahead of unrelated servers.
• Non-HTML listeners such as Zotero's local ports and Steam still don't appear. The HTML probe stays the gate.

Not requested

No scanning of non-loopback interfaces. No change to the probe timeout or cache rules. No killing or restarting services from the list.