fix(v0.4): mirror size-clamp bug + session manager page

The mirror looked broken because a backgrounded tab on one device still pinned
the shared PTY to its (default 80x24) size — so the device actively viewing got
a cramped terminal.

Fix: only an ACTIVELY-VIEWING client votes on PTY size.
- attachWs no longer seeds a default size vote (a join may be a hidden mirror)
- new 'blur' client message + clearClientDims(): a tab going hidden withdraws its
  size vote (still mirrors output); show() re-casts it
- PTY size = min cols/rows across clients that have actually reported dims
- session/protocol tests cover hidden-mirror-doesn't-clamp + blur

Session manager (separate page, for the 'too many sessions' problem):
- GET stays; add DELETE /live-sessions/:id and DELETE /live-sessions[?detached=1]
- manager.killById(); LiveSessionInfo gains cols/rows
- public/manage.html + manage.ts: list/open/kill sessions, kill-all / kill-detached,
  auto-refresh; 🗂 toolbar button; bundled as a 2nd esbuild entry

Verified: two concurrent clients mirror output + shared input; manage page
lists/kills (3→2→0). 225 tests green, tsc clean.

public/main.ts

@@ -67,6 +67,18 @@ mountHistory(toolbar, {
 })
 mountShortcuts(toolbar)
 mountShareSession(toolbar, () => app.activeSessionId())
+
+// Session manager (standalone page) — manage/kill the host's running sessions.
+const manageBtn = document.createElement('button')
+manageBtn.className = 'toolbtn'
+manageBtn.textContent = '🗂'
+manageBtn.title = 'Manage sessions (open / kill)'
+manageBtn.setAttribute('aria-label', 'Manage sessions')
+manageBtn.addEventListener('click', () => {
+  location.href = '/manage.html'
+})
+toolbar.appendChild(manageBtn)
+
 mountQrConnect(toolbar)
 
 // PWA: register the service worker (installable + offline shell, M4).