fix(v0.4): mirror size-clamp bug + session manager page

The mirror looked broken because a backgrounded tab on one device still pinned
the shared PTY to its (default 80x24) size — so the device actively viewing got
a cramped terminal.

Fix: only an ACTIVELY-VIEWING client votes on PTY size.
- attachWs no longer seeds a default size vote (a join may be a hidden mirror)
- new 'blur' client message + clearClientDims(): a tab going hidden withdraws its
  size vote (still mirrors output); show() re-casts it
- PTY size = min cols/rows across clients that have actually reported dims
- session/protocol tests cover hidden-mirror-doesn't-clamp + blur

Session manager (separate page, for the 'too many sessions' problem):
- GET stays; add DELETE /live-sessions/:id and DELETE /live-sessions[?detached=1]
- manager.killById(); LiveSessionInfo gains cols/rows
- public/manage.html + manage.ts: list/open/kill sessions, kill-all / kill-detached,
  auto-refresh; 🗂 toolbar button; bundled as a 2nd esbuild entry

Verified: two concurrent clients mirror output + shared input; manage page
lists/kills (3→2→0). 225 tests green, tsc clean.

src/server.ts

@@ -39,7 +39,7 @@ import { isOriginAllowed } from './http/origin.js'
 import { parseHookEvent } from './http/hook.js'
 import { listSessions } from './http/history.js'
 import { createSessionManager } from './session/manager.js'
-import { detachWs, writeInput, setClientDims } from './session/session.js'
+import { detachWs, writeInput, setClientDims, clearClientDims } from './session/session.js'
 import type { Config } from './types.js'
 import { WS_OPEN } from './types.js'
 
@@ -117,6 +117,23 @@ export function startServer(cfg: Config): { close(): Promise<void> } {
     res.json(manager.list())
   })
 
+  // Kill ALL sessions, or only detached ones (?detached=1) — manage page bulk action.
+  app.delete('/live-sessions', (req, res) => {
+    const onlyDetached = req.query['detached'] === '1'
+    let killed = 0
+    for (const s of manager.list()) {
+      if (onlyDetached && s.clientCount > 0) continue
+      if (manager.killById(s.id)) killed += 1
+    }
+    res.json({ killed })
+  })
+
+  // Kill one session by id — manage page per-row action.
+  app.delete('/live-sessions/:id', (req, res) => {
+    const ok = manager.killById(req.params.id)
+    res.status(ok ? 204 : 404).end()
+  })
+
   // ── Claude Code hook side-channel (H2) ────────────────────────────────────
   // Hooks running inside a spawned shell POST status here (loopback only — the
   // shell runs on the host). sessionId arrives in the X-Webterm-Session header.
@@ -268,8 +285,11 @@ export function startServer(cfg: Config): { close(): Promise<void> } {
       if (msg.type === 'input') {
         writeInput(session, msg.data)
       } else if (msg.type === 'resize') {
-        // Per-client dims; the PTY tracks the min across all sharing devices.
+        // Per-client dims; the PTY tracks the min across actively-viewing devices.
         setClientDims(session, ws, msg.cols, msg.rows)
+      } else if (msg.type === 'blur') {
+        // Tab hidden on this device — withdraw its size vote (still mirrors output).
+        clearClientDims(session, ws)
       } else if (msg.type === 'approve') {
         // H3: resolve the held PermissionRequest with allow.
         resolvePending(boundSessionId, permDecision('allow'))