Server
- New `commit_diff_payload(git_dir, oid)` in `crates/server/src/main.rs`.
  Runs `git show --no-color --find-renames --format=… --patch <oid>`
  through the existing `git_text` helper, splits the SOH-delimited
  header from the unified-patch body, and emits a structured envelope
  with `oid / shortOid / subject / body / author / authorEmail /
  time / parents / changeId / patch / error`.
- Input validation: `is_valid_oid` rejects anything that isn't 4-40
  ASCII hex characters before reaching `git`. Belt-and-braces against
  a caller-controlled OID parsing as a ref/option even though the
  Command builder already prevents shell injection.
- Wired into the `repositoryByPath` enrichment block in
  `graphql_response`: when the GraphQL query mentions `commitDiff`
  AND `variables.oid` is set, the field is populated. Matches the
  JSON-shim pattern already used for the rest of `repositoryByPath`.
- 2 new tests:
  - `graphql_commit_diff_returns_metadata_and_patch_for_head` —
    end-to-end: resolves HEAD, asserts oid/shortOid round-trip and
    a non-error envelope with a unified-diff patch.
  - `graphql_commit_diff_returns_error_envelope_for_malformed_oid`
    — input validation surfaces an envelope-level `error` rather
    than bubbling up as a GraphQL error.
- 185/185 server tests green; clippy --workspace clean.

Frontend
- New `frontend/src/diff.ts` (204 lines). Minimal unified-diff
  parser: `diff --git` file breaks, hunk headers, +/- line
  classification with old/new line numbers, status tagging
  (added/deleted/renamed/modified, binary), per-file additions/
  deletions, plus a `summarize()` helper. Shared with the PR
  DiffView once that refactor lands.
- New `frontend/src/routes/CommitDetail.vue` (276 lines). Headers
  (`{repoPath} / {shortOid}` chip + RepoTabs), metadata block
  (author, email, time, change-id chip, body), summary chips
  (file count, +/-), and an ordered list of per-file diffs with
  expand/collapse and per-hunk tables. Renders loading / missing /
  error / empty-diff states explicitly.
- Router entry at `/r/:groups+/:repo/commits/:oid` (`repoCommitDetail`
  shellRoutePath). Registered BEFORE `repoPipelines` to match the
  declaration-order convention the existing file uses.
- Back-link points to the repo home until a dedicated Commits-list
  view ships; parent-commit chips link to the same
  `/commits/:parent` route so the user can walk history.
- `bun test` 89/89 green; `vue-tsc` clean; `vite build` clean.

UI verification blocker
- Per CLAUDE.md UI Hard Rule, this PR should not merge until a real
  browser confirms the page renders, the diff displays correctly,
  and `/commits/:oid` is reachable from the shell. Both Chrome MCPs
  are unavailable this session (claude-in-chrome extension
  disconnected; chrome-devtools can't locate Chrome at
  `/Applications/Google Chrome.app/...`). Server contract is
  verified by curl probes + unit tests; the frontend wiring needs
  a human or a reconnected Chrome MCP to flip ready.