fix(v0.4): mirror size-clamp bug + session manager page

The mirror looked broken because a backgrounded tab on one device still pinned
the shared PTY to its (default 80x24) size — so the device actively viewing got
a cramped terminal.

Fix: only an ACTIVELY-VIEWING client votes on PTY size.
- attachWs no longer seeds a default size vote (a join may be a hidden mirror)
- new 'blur' client message + clearClientDims(): a tab going hidden withdraws its
  size vote (still mirrors output); show() re-casts it
- PTY size = min cols/rows across clients that have actually reported dims
- session/protocol tests cover hidden-mirror-doesn't-clamp + blur

Session manager (separate page, for the 'too many sessions' problem):
- GET stays; add DELETE /live-sessions/:id and DELETE /live-sessions[?detached=1]
- manager.killById(); LiveSessionInfo gains cols/rows
- public/manage.html + manage.ts: list/open/kill sessions, kill-all / kill-detached,
  auto-refresh; 🗂 toolbar button; bundled as a 2nd esbuild entry

Verified: two concurrent clients mirror output + shared input; manage page
lists/kills (3→2→0). 225 tests green, tsc clean.

test/protocol.test.ts

@@ -116,6 +116,12 @@ describe('parseClientMessage — valid messages', () => {
     expect(r.ok).toBe(true)
     if (r.ok) expect(r.message).toEqual({ type: 'reject' })
   })
+
+  it('parses blur (v0.4, no payload — withdraw size vote)', () => {
+    const b = parseClientMessage(JSON.stringify({ type: 'blur' }))
+    expect(b.ok).toBe(true)
+    if (b.ok) expect(b.message).toEqual({ type: 'blur' })
+  })
 })
 
 // ─── parseClientMessage — invalid / error paths ───────────────────────────────