fix: address review report across security, architecture, quality, tests

Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review).
typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage
thresholds (80%) enforced in vitest.config.ts.

Critical:
- multi-device approval race: release held approval only when the last
  client detaches (closing one mirror no longer cancels another's prompt)
- unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS),
  enforced in manager via the existing M4 exit(-1) path
- signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close()
- terminal-session initialInput timer tracked + cleared on dispose
- tabs.addEntry null-as-cast type hole removed (build session before entry)

Should-fix:
- security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id]
- history.ts converted to fs/promises (async /sessions handler)
- removed dead clientDims map + blur protocol message end-to-end
- per-connection WS message rate limit (Config.maxMsgsPerSec)
- /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7)

Tests:
- new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites
- extended history/config/manager/integration coverage incl. regressions

Hygiene:
- parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation
- log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped
- operational constants moved into Config
- extracted public/preview-grid.ts (DRY launcher/manage)
- doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments

public/launcher.ts

@@ -5,28 +5,20 @@
  * start screen lists the host's running sessions as live preview thumbnails
  * (read-only xterm, same as the manage page) so the user picks which to open —
  * or starts a new one. Sessions persist server-side, so opening one replays its
- * full scrollback.
+ * full scrollback. The thumbnail card + preview plumbing is shared with the
+ * manage page via public/preview-grid.ts (DRY).
  */
 
-import { Terminal } from '@xterm/xterm'
-
-interface LiveSession {
-  id: string
-  createdAt: number
-  clientCount: number
-  status: 'working' | 'waiting' | 'idle' | 'unknown'
-  exited: boolean
-  cwd: string | null
-  cols: number
-  rows: number
-}
-
-interface Preview {
-  id: string
-  cols: number
-  rows: number
-  data: string
-}
+import type { LiveSessionInfo } from '../src/types.js'
+import {
+  el,
+  relTime,
+  makePreviewCard,
+  updatePreviewCard,
+  loadPreviewInto,
+  fetchLiveSessions,
+  type PreviewCard,
+} from './preview-grid.js'
 
 export interface LauncherHooks {
   onOpen: (id: string) => void
@@ -36,45 +28,6 @@ export interface LauncherHooks {
 const THUMB_W = 320
 const THUMB_MAX_H = 200
 const REFRESH_MS = 5000
-const CLEAR = '\x1b[2J\x1b[3J\x1b[H\x1b[0m'
-const THEME = { background: '#0e0f13', foreground: '#e7e8ec', cursor: '#0e0f13' }
-
-function el<K extends keyof HTMLElementTagNameMap>(
-  tag: K,
-  cls?: string,
-  text?: string,
-): HTMLElementTagNameMap[K] {
-  const node = document.createElement(tag)
-  if (cls) node.className = cls
-  if (text !== undefined) node.textContent = text
-  return node
-}
-
-function relTime(ms: number): string {
-  const s = Math.max(0, (Date.now() - ms) / 1000)
-  if (s < 60) return `${Math.floor(s)}s`
-  if (s < 3600) return `${Math.floor(s / 60)}m`
-  if (s < 86400) return `${Math.floor(s / 3600)}h`
-  return `${Math.floor(s / 86400)}d`
-}
-
-function statusText(s: LiveSession['status']): string {
-  return s === 'working' ? '⚙ working' : s === 'waiting' ? '⏳ waiting' : s === 'idle' ? '✓ idle' : '·'
-}
-
-function sessionName(s: LiveSession): string {
-  return s.cwd ? (s.cwd.split('/').filter(Boolean).pop() ?? s.cwd) : s.id.slice(0, 8)
-}
-
-interface Card {
-  el: HTMLElement
-  term: Terminal
-  inner: HTMLElement
-  thumb: HTMLElement
-  watch: HTMLElement
-  status: HTMLElement
-  meta: HTMLElement
-}
 
 export interface Launcher {
   setVisible(v: boolean): void
@@ -101,77 +54,15 @@ export function mountLauncher(host: HTMLElement, hooks: LauncherHooks): Launcher
   const grid = el('div', 'mg-grid')
   root.append(grid)
 
-  const cards = new Map<string, Card>()
+  const cards = new Map<string, PreviewCard>()
   let timer: ReturnType<typeof setInterval> | null = null
 
-  function fit(card: Card): void {
-    const w = card.inner.offsetWidth
-    const h = card.inner.offsetHeight
-    if (w === 0 || h === 0) return
-    const scale = Math.min(1, THUMB_W / w)
-    card.inner.style.transform = `scale(${scale})`
-    card.thumb.style.height = `${Math.min(h * scale, THUMB_MAX_H)}px`
-  }
-
-  function makeCard(s: LiveSession): Card {
-    const cardEl = el('div', 'mg-card')
-    const h = el('div', 'mg-card-head')
-    const title = el('span', 'mg-name', sessionName(s))
-    const status = el('span', `mg-status mg-${s.status}`, statusText(s.status))
-    const watch = el('span', s.clientCount > 0 ? 'mg-watch live' : 'mg-watch', `👁 ${s.clientCount}`)
-    h.append(title, status, watch)
-
-    const thumb = el('div', 'mg-thumb')
-    const inner = el('div', 'mg-thumb-inner')
-    thumb.append(inner)
-    thumb.addEventListener('click', () => hooks.onOpen(s.id))
-
-    const meta = el('div', 'mg-meta')
-    const actions2 = el('div', 'mg-actions')
-    const open = el('button', 'mg-open', 'Open ↗')
-    open.addEventListener('click', () => hooks.onOpen(s.id))
-    actions2.append(open)
-
-    const term = new Terminal({
-      cols: Math.max(2, s.cols),
-      rows: Math.max(2, s.rows),
-      disableStdin: true,
-      cursorBlink: false,
-      fontFamily: 'Menlo, Consolas, monospace',
-      fontSize: 12,
-      scrollback: 0,
-      theme: THEME,
-    })
-    term.open(inner)
-
-    cardEl.append(h, thumb, meta, actions2)
-    return { el: cardEl, term, inner, thumb, watch, status, meta }
-  }
-
-  async function loadPreview(id: string, card: Card): Promise<void> {
-    try {
-      const res = await fetch(`/live-sessions/${id}/preview`)
-      if (!res.ok) return
-      const p = (await res.json()) as Preview
-      if (card.term.cols !== Math.max(2, p.cols) || card.term.rows !== Math.max(2, p.rows)) {
-        card.term.resize(Math.max(2, p.cols), Math.max(2, p.rows))
-      }
-      card.term.reset()
-      card.term.write(CLEAR + p.data, () => requestAnimationFrame(() => fit(card)))
-    } catch {
-      /* preview is best-effort */
-    }
+  function makeCard(s: LiveSessionInfo): PreviewCard {
+    return makePreviewCard(s, { onOpen: (id) => hooks.onOpen(id) })
   }
 
   async function refresh(): Promise<void> {
-    let sessions: LiveSession[] = []
-    try {
-      const res = await fetch('/live-sessions')
-      const data: unknown = await res.json()
-      if (Array.isArray(data)) sessions = data as LiveSession[]
-    } catch {
-      sessions = []
-    }
+    const sessions = await fetchLiveSessions()
 
     sub.textContent = sessions.length
       ? `${sessions.length} running on this host — pick one to open`
@@ -186,12 +77,9 @@ export function mountLauncher(host: HTMLElement, hooks: LauncherHooks): Launcher
         cards.set(s.id, card)
         grid.append(card.el)
       }
-      card.status.className = `mg-status mg-${s.status}`
-      card.status.textContent = statusText(s.status)
-      card.watch.className = s.clientCount > 0 ? 'mg-watch live' : 'mg-watch'
-      card.watch.textContent = `👁 ${s.clientCount}`
+      updatePreviewCard(card, s)
       card.meta.textContent = `${s.cwd ?? 'unknown dir'} · ${s.cols}×${s.rows} · ${relTime(s.createdAt)} old`
-      void loadPreview(s.id, card)
+      void loadPreviewInto(s.id, card, THUMB_W, THUMB_MAX_H)
     }
     for (const [id, card] of cards) {
       if (!seen.has(id)) {