fix(scripts): AuthContext binding + load() cache invalidation (Codex review)

Codex (deepseek-v4-flash) review of feat(scripts) parent_path filter
surfaced four problems:

1. Critical — AuthContext listScripts binding silently dropped parentPath
   - frontend/app/context/AuthContext.tsx:224 had:
       listScripts: () => rawApi.listScripts(workspaceId)
     so loadScripts("foo/bar") hit GET /api/v1/scripts with no query and
     always received root-level scripts. Typecheck passed because
     `() => ...` is assignable to `(parentPath?: string) => ...`.
   - Fix: forward the parentPath argument.

2. High — load() cache invalidation gap on toolbar refresh / create / delete
   - load() replaced `scripts` with root-only items but never invalidated
     `loadedScriptPaths` for subfolders, so previously-expanded folders
     rendered empty (cached no-op on re-expand) and open tabs pointing
     into subfolders were dropped by the validIds filter.
   - Fix: load() now re-fetches every path currently in
     loadedScriptPaths (and loadedChildPaths for directories), then
     dedups by id/path. On initial mount the cache is empty so this
     degrades to a single root fetch.

3. Low — test docstring overclaimed coverage
   - The "actual ORM roundtrip is covered by the existing integration
     tests" line is false (no other list_scripts test exists).
   - Fix: honest docstring noting the repo has no endpoint integration
     test layer; SQL assertions are brittle to SQLAlchemy/dialect
     formatting.

4. Low — backend docstring overclaimed index role
   - Claimed `idx_storage_workspace_relative_path` "avoided全表扫", but
     the index isn't declared in the ORM model, only exists via the
     baseline migration's upgrade path, and EXPLAIN doesn't drive
     through it (scripts-first plan via idx_scripts_workspace).
   - Fix: accurate description — MySQL drives via idx_scripts_workspace,
     storage_objects PK lookup applies LIKE per row. Notes where to
     optimize if 10万-scale perf becomes a real problem.

Skipped findings (out of scope):
- Medium LIKE escape for `_` / `%` (pre-existing in
  list_workspace_directories; not introduced here).
- Low dashboard `scripts.length` count underreport (separate UI bug,
  pre-existing assumption that broke under the new semantics).

Verified: pytest 50 passed, pnpm typecheck clean.

backend/tests/test_list_scripts_parent_path.py

@@ -2,9 +2,11 @@
 
 Verifies the WHERE clause built by the endpoint encodes the intended
 "direct children of parent_path" semantics: ``relative_path LIKE 'prefix/%'``
-and ``NOT LIKE 'prefix/%/%'``. The actual ORM roundtrip is covered by the
-existing integration tests; here we only care that the filter contract is
-intact, so an AsyncMock session is enough.
+and ``NOT LIKE 'prefix/%/%'``. These are SQL-contract assertions (mock
+session, capture compiled SQL); the repo has no integration test layer
+for endpoints, so this is the only coverage. Brittle to SQLAlchemy/dialect
+rendering changes — review the assertions together with the endpoint if
+you upgrade SQLAlchemy.
 
 Mirrors the pattern in test_scripts.py (unit-level, no live DB).
 """