fix: address review report across security, architecture, quality, tests

Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review).
typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage
thresholds (80%) enforced in vitest.config.ts.

Critical:
- multi-device approval race: release held approval only when the last
  client detaches (closing one mirror no longer cancels another's prompt)
- unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS),
  enforced in manager via the existing M4 exit(-1) path
- signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close()
- terminal-session initialInput timer tracked + cleared on dispose
- tabs.addEntry null-as-cast type hole removed (build session before entry)

Should-fix:
- security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id]
- history.ts converted to fs/promises (async /sessions handler)
- removed dead clientDims map + blur protocol message end-to-end
- per-connection WS message rate limit (Config.maxMsgsPerSec)
- /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7)

Tests:
- new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites
- extended history/config/manager/integration coverage incl. regressions

Hygiene:
- parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation
- log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped
- operational constants moved into Config
- extracted public/preview-grid.ts (DRY launcher/manage)
- doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments

src/protocol.ts

@@ -24,7 +24,7 @@ export const SESSION_ID_RE =
 
 // ─── Type whitelist ───────────────────────────────────────────────────────────
 
-const ALLOWED_TYPES = new Set<string>(['attach', 'input', 'resize', 'blur', 'approve', 'reject'])
+const ALLOWED_TYPES = new Set<string>(['attach', 'input', 'resize', 'approve', 'reject'])
 
 // ─── parseClientMessage ───────────────────────────────────────────────────────
 
@@ -73,11 +73,6 @@ export function parseClientMessage(raw: string): ParseResult {
     return validateInput(obj)
   }
 
-  // blur (v0.4) carries no payload — withdraw this client's size vote.
-  if (type === 'blur') {
-    return { ok: true, message: { type: 'blur' } }
-  }
-
   // approve/reject (H3) carry no payload.
   if (type === 'approve') {
     return { ok: true, message: { type: 'approve' } }
@@ -139,6 +134,11 @@ function validateAttach(obj: Record<string, unknown>): ParseResult {
   }
 
   // Optional cwd (M6): must be an absolute path string if present.
+  // NOTE (Sec L2): the only check here is a leading '/'. Any further path
+  // normalisation (e.g. path.resolve) stays on the backend (session.ts), because
+  // this module is shared with the browser bundle and must NOT import node:path.
+  // Within the current threat model this is informational — the caller already
+  // has a full shell, so a crafted cwd grants nothing beyond what they can type.
   const rawCwd = obj['cwd']
   let cwd: string | undefined
   if (rawCwd !== undefined) {