fix: address review report across security, architecture, quality, tests

Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review).
typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage
thresholds (80%) enforced in vitest.config.ts.

Critical:
- multi-device approval race: release held approval only when the last
  client detaches (closing one mirror no longer cancels another's prompt)
- unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS),
  enforced in manager via the existing M4 exit(-1) path
- signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close()
- terminal-session initialInput timer tracked + cleared on dispose
- tabs.addEntry null-as-cast type hole removed (build session before entry)

Should-fix:
- security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id]
- history.ts converted to fs/promises (async /sessions handler)
- removed dead clientDims map + blur protocol message end-to-end
- per-connection WS message rate limit (Config.maxMsgsPerSec)
- /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7)

Tests:
- new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites
- extended history/config/manager/integration coverage incl. regressions

Hygiene:
- parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation
- log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped
- operational constants moved into Config
- extracted public/preview-grid.ts (DRY launcher/manage)
- doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments

src/types.ts

@@ -27,6 +27,11 @@ export interface Config {
   readonly scrollbackBytes: number; // ring buffer capacity, default 2MB
   readonly maxPayloadBytes: number; // max WS frame bytes, default 1MB (L5)
   readonly wsPath: string; // WS upgrade path, default '/term' (L3; invariant 8)
+  readonly maxSessions: number; // cap on concurrent PTY sessions (DoS guard), default 50
+  readonly maxMsgsPerSec: number; // per-connection WS message rate cap (DoS guard), default 2000
+  readonly permTimeoutMs: number; // H3: how long a held PermissionRequest waits before fallback
+  readonly reapIntervalMs: number; // idle-reaper sweep interval
+  readonly previewBytes: number; // manage-page preview: bytes of scrollback tail rendered
   readonly useTmux: boolean; // H1: spawn the shell inside tmux so it survives a server restart
   readonly allowedOrigins: readonly string[]; // derived from NIC IPs, NOT bindHost (M1)
 }
@@ -45,9 +50,6 @@ export type ClientMessage =
   | { type: 'attach'; sessionId: string | null; cwd?: string }
   | { type: 'input'; data: string }
   | { type: 'resize'; cols: number; rows: number }
-  // v0.4: this client stopped actively viewing (tab hidden) — withdraw its size
-  // vote so a background mirror doesn't clamp the shared PTY (min-dims).
-  | { type: 'blur' }
   | { type: 'approve' }
   | { type: 'reject' };
 
@@ -150,9 +152,6 @@ export interface Session {
    *  detached but PTY still alive (vibe-coding core). Output/exit/status are
    *  broadcast to every client; any client can send input (shared control). */
   readonly clients: Set<WebSocketLike>;
-  /** Per-client requested terminal dims; the PTY uses the MIN cols/rows across
-   *  all clients (tmux-style) so every device sees content without overflow. */
-  readonly clientDims: Map<WebSocketLike, Dims>;
   /** Time the LAST client left (clients became empty); null while ≥1 attached. */
   detachedAt: number | null;
   /** last pty.onData timestamp; reapIdle liveness proxy (M3). */
@@ -176,8 +175,7 @@ export interface Session {
 //   attachWs(session: Session, ws: WebSocketLike): void             // adds a client, replays buffer (no size vote until it resizes)
 //   detachWs(session: Session, ws: WebSocketLike, now: number): void // removes one client; never kills PTY
 //   writeInput(session: Session, data: string): void                // no-op after exit (L4)
-//   setClientDims(session: Session, ws: WebSocketLike, cols, rows): void  // PTY = min over active viewers (L4 no-op after exit)
-//   clearClientDims(session: Session, ws: WebSocketLike): void      // withdraw this client's size vote (tab hidden / blur)
+//   setClientDims(session: Session, ws: WebSocketLike, cols, rows): void  // PTY = latest-writer-wins (L4 no-op after exit)
 //   kill(session: Session): void
 
 /* ──────────────────────── manager (§3.5) ─────────────────────── */