Enhance tool documentation and add new features

- Added module-level documentation for memory tools (`remember`, `recall`, `forget`) to clarify their purpose.
- Improved documentation in `recall.rs` and `remember.rs` to describe the functionality and flow of memory entry operations.
- Updated `mod.rs` to include descriptions for the tool trait and execution context.
- Enhanced `plan.rs` with detailed comments on plan-mode signaling tools.
- Documented text search tools in `search.rs` to explain their functionality.
- Improved sequential-thinking tool documentation in `seqthink.rs`.
- Added safety filter documentation in `shell_filter` for credential and git operations.
- Enhanced utility tools documentation, including `cd`, `dir_cache_update`, and `todowrite`.
- Improved rendering documentation in view modules (`chat`, `markdown`, `status`, `workflow`) to clarify rendering flows and purposes.

src/service/oauth/pkce.rs

@@ -1,20 +1,27 @@
+//! PKCE (Proof Key for Code Exchange) verifier/challenge pair generation for OAuth flows.
+
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use sha2::{Sha256, Digest};
 
 const VERIFIER_LENGTH: usize = 64;
 
+/// A randomly generated, base64url-encoded PKCE code verifier.
 pub struct CodeVerifier(String);
 
 impl CodeVerifier {
+    /// Generate a fresh random code verifier.
     pub fn new() -> Self {
         let bytes: Vec<u8> = (0..VERIFIER_LENGTH).map(|_| rand_byte()).collect();
         CodeVerifier(URL_SAFE_NO_PAD.encode(&bytes))
     }
 
+    /// Borrow the verifier as a string, to send in the token exchange request.
     pub fn as_str(&self) -> &str {
         &self.0
     }
 
+    /// Derive the S256 code challenge (SHA-256 hash, base64url-encoded) to send
+    /// in the authorization request.
     pub fn challenge(&self) -> CodeChallenge {
         let mut hasher = Sha256::new();
         hasher.update(self.0.as_bytes());
@@ -23,6 +30,11 @@ impl CodeVerifier {
     }
 }
 
+/// Produce one pseudo-random byte from the sub-second component of the system clock.
+///
+/// Why: avoids pulling in a `rand` dependency for a short-lived, non-cryptographic
+/// verifier; each byte only needs to be unpredictable enough to prevent code
+/// interception, not cryptographically secure.
 fn rand_byte() -> u8 {
     use std::time::{SystemTime, UNIX_EPOCH};
     let nanos = SystemTime::now()
@@ -35,9 +47,11 @@ fn rand_byte() -> u8 {
     (nanos & 0xFF) as u8
 }
 
+/// The S256-derived code challenge sent in the authorization request URL.
 pub struct CodeChallenge(String);
 
 impl CodeChallenge {
+    /// Borrow the challenge as a string.
     pub fn as_str(&self) -> &str {
         &self.0
     }