fix: address review report across security, architecture, quality, tests

Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review).
typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage
thresholds (80%) enforced in vitest.config.ts.

Critical:
- multi-device approval race: release held approval only when the last
  client detaches (closing one mirror no longer cancels another's prompt)
- unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS),
  enforced in manager via the existing M4 exit(-1) path
- signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close()
- terminal-session initialInput timer tracked + cleared on dispose
- tabs.addEntry null-as-cast type hole removed (build session before entry)

Should-fix:
- security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id]
- history.ts converted to fs/promises (async /sessions handler)
- removed dead clientDims map + blur protocol message end-to-end
- per-connection WS message rate limit (Config.maxMsgsPerSec)
- /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7)

Tests:
- new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites
- extended history/config/manager/integration coverage incl. regressions

Hygiene:
- parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation
- log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped
- operational constants moved into Config
- extracted public/preview-grid.ts (DRY launcher/manage)
- doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments

public/tabs.ts

@@ -146,14 +146,11 @@ export class TabApp {
     cwd?: string,
     initialInput?: string,
   ): TabEntry {
-    const entry: TabEntry = {
-      session: null as unknown as TerminalSession,
-      customTitle,
-      autoTitle: null,
-      hasActivity: false,
-      el: null,
-    }
-    entry.session = new TerminalSession({
+    // Build the session FIRST so `entry` is never typed with a null session.
+    // The callbacks below capture `entry` by reference; they only fire after
+    // construction (async), by which point `entry` is assigned.
+    let entry: TabEntry
+    const session = new TerminalSession({
       sessionId,
       ...(cwd !== undefined ? { cwd } : {}),
       ...(initialInput !== undefined ? { initialInput } : {}),
@@ -177,10 +174,11 @@ export class TabApp {
         }
       },
     })
-    this.paneHost.appendChild(entry.session.el)
+    entry = { session, customTitle, autoTitle: null, hasActivity: false, el: null }
+    this.paneHost.appendChild(session.el)
     this.tabs.push(entry)
-    entry.session.applyTheme(THEMES[this.settings.theme] ?? THEMES['dark']!, this.settings.fontSize)
-    entry.session.connect()
+    session.applyTheme(THEMES[this.settings.theme] ?? THEMES['dark']!, this.settings.fontSize)
+    session.connect()
     return entry
   }