Offer a writable database location instead of failing the open

`ida-tui /bin/ls` asked IDA to create /bin/ls.i64, which a normal user
cannot write, and what came back was the backend's account of it:

    idalib worker launcher 2425195 exited with status 1
    [ida-nexus] Failed to open database /usr/bin/ls

after a full analysis wait, naming neither the file it could not create
nor the reason. Nothing in the message points at permissions, and there
was no way forward from it.

idatui/idbpath.py answers the question before anything is opened: where
would the database go (mirroring ida_nexus's own derivation), can it go
there (os.access only — the pre-flight check must not create files), and
where instead. The proposal is stable per binary
(~/.local/share/idatui/db/<name>-<sha1(realpath)[:8]>.i64) so reopening
the same binary resumes the same names and comments, and hashed so two
busyboxes from different directories cannot collide. DATA_HOME rather
than CACHE_HOME on purpose: an .i64 holds the whole session, and cache
directories are something cleaners may empty.

The answer becomes NexusClient(output_database=...) — the option project
mode already uses to keep everything in its sidecar. `--idb PATH` (also
forwarded by `pane spawn`) says where without being asked. An RPC-driven
TUI is never asked: `pane spawn` polls for ready and would sit out its
whole timeout in front of a modal nobody can answer, so it relocates and
says so in the status line. A failed open re-offers relocation after a
real create probe, since os.access does not know about ACLs, a lying
network mount or a full disk.

tests/test_idbpath.py (pure, 32 checks) pins the path arithmetic, the two
properties of the proposal and that neither check touches the user's
directory; tests/test_idb_relocate_ui.py (textual, no worker, 24 checks)
drives the dialog, Esc, an edited path, the untouched common case, --idb,
the RPC path, and that output_database actually reaches the client.
Verified end to end against a real /bin/ls: 400 functions, and a rename
saved in one session comes back in the next.

1 files changed, 13 insertions, 0 deletions

diff --git a/idatui/pane.py b/idatui/pane.py
index 67b462b..51028ae 100644
--- a/idatui/pane.py
+++ b/idatui/pane.py
@@ -361,6 +361,13 @@ def spawn(args) -> int:
             inner += ["--" + opt.replace("_", "-"), str(val)]
     if getattr(args, "trace", None):
         inner += ["--trace", os.path.abspath(os.path.expanduser(args.trace))]
+    # Where the database goes, for a binary whose own directory cannot hold one
+    # (/bin/ls). Without it the TUI picks a writable location itself and says so
+    # in the status line -- an RPC-driven pane is never asked, because nothing
+    # would answer and spawn would wait out its whole timeout in front of the
+    # dialog. Pass it when the location matters.
+    if getattr(args, "idb", None):
+        inner += ["--idb", os.path.abspath(os.path.expanduser(args.idb))]
 
     if args.size and mux == "zellij":
         print(
@@ -651,6 +658,12 @@ def main(argv: list[str]) -> int:
         help="extra IDA command-line switches, passed through",
     )
     sp.add_argument(
+        "--idb",
+        metavar="FILE",
+        help="keep the database at this .i64 path instead of beside the binary "
+        "(passed to idatui.launch)",
+    )
+    sp.add_argument(
         "--sock", help="RPC socket path (default: auto in $XDG_RUNTIME_DIR)"
     )
     sp.add_argument(