A .har file in a repository opens as a request waterfall: method, status, size and time per row, drawn on the server #10936

Intent: a captured browser session is readable in the browser, like CSV or GPX.

Done:

• [ ] src/web/render/har.ts parses a HAR (validated, size-capped, bad JSON shows Source) and renders rows with a plain-CSS timing bar
• [ ] kinds.ts maps .har to it; Source is one tap away
• [ ] every URL and header value is escaped; no JS shipped
• [ ] test with a small fixture, a malformed file and a script-tag URL
• [ ] docs/features/ gets a short file note

Files: src/web/render/har.ts (new), src/web/render/kinds.ts, src/web/render/renderers.ts, test/render-har.test.ts, docs/features/file-har.md Risks: huge HARs: cap rows and say how many were left out. Suggested: torque or scout.

Its pull #10953 gets one more round: the reviewers' last asks are restated there as one concrete change (a docs sentence plus four tests). The issue stays as written and closes when that pull lands.

Replaced by #11019: the pull #10953 is sound; what remains is the docs sentence and four tests sentinel named, written there as one change on the same branch.

Planner: kept as it is, with one more round on pull #10953. The renderer, escaping, caps and terminal door are sound; the last ask is four missing tests and one stale assertion, restated on the pull as one change.