Space: what is using a disk, WizTree-style

Pick a disk, not a partition; the scan walks every filesystem it backs, as root when
the host allows, in a helper process that streams the tree back. A tree of folders
largest-first over a treemap of the selected folder, nested to the file and coloured by
kind, plus the thousand largest files. The rail no longer offers the hub-only pages
while a remote machine is being looked at.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

PLAN.md

@@ -326,6 +326,28 @@ something long in one, switch away and back, refresh — it's all still there.
   `hamlab passwd [user]` (makes the account if new; reads stdin when piped), `hamlab
   users`, `hamlab user-rm <user>`; `hamlab install` names the first account after the
   service user. Not done: a read-only viewer role.
+- **Space tab** — **shipped 2026-09-22** (`internal/space`, `internal/api/space.go`,
+  `Space.tsx`), asked for as "exactly WizTree": what is using a disk. A **disk** is picked at
+  the top, not a partition: the scan covers every filesystem the disk backs — its partitions'
+  mountpoints, and for a disk in a ZFS pool every mounted dataset of the pool (any of `tank`'s
+  eight disks shows `tank`). The walk runs as a helper process, `hamlab space-walk <roots>`,
+  as root through `priv` when the host allows (so `/var/lib/docker` and `/root` count), 16
+  workers reading directories depth-first, never crossing a filesystem boundary by itself;
+  each root is grafted into one tree at its path. Files under 128 KiB are not kept one by one
+  but summed per folder as "N smaller files" — what keeps a scan of millions of files to tens
+  of MB in the daemon; the tree crosses back as a varint stream (`codec.go`), and the helper's
+  memory goes with it. core's root: 646k files in ~1.2 s. Progress (files, bytes, current
+  folder) every 250 ms; Cancel sends SIGTERM. The page: disk chips → Scan/Rescan → **Folders**
+  (a tree largest-first: size, share of parent as a bar, files, folders, modified; expand in
+  place) over a **treemap** of the selected folder — squarified, nested to the file, tiles
+  coloured by kind (video, images, audio, archives & disk images, documents, code & config,
+  databases & logs, other; the validated categorical set, dark and light) with folders as
+  labelled boxes; hover for path, size and share; click a folder to drill, breadcrumbs and ↑
+  to come back. The map asks the server for the folder pruned to what a tile could show
+  (`min` = 1/4000 of the folder, depth 12), the list one level at a time. **Largest files**:
+  the 1,000 biggest with a path filter. Works on every machine through the hub. Not kept
+  across a restart; not done: delete from here, a size-over-time history, per-user column
+  choices.
 - **Auth hardening** — WebAuthn passkeys (phone Face ID), TOTP fallback, optional NPM
   access list restricting to WireGuard/LAN.
 - **Files tab** — **shipped 2026-09-18** (`internal/files`, `Files.tsx`): browse from