fix: address review report across security, architecture, quality, tests

Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review).
typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage
thresholds (80%) enforced in vitest.config.ts.

Critical:
- multi-device approval race: release held approval only when the last
  client detaches (closing one mirror no longer cancels another's prompt)
- unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS),
  enforced in manager via the existing M4 exit(-1) path
- signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close()
- terminal-session initialInput timer tracked + cleared on dispose
- tabs.addEntry null-as-cast type hole removed (build session before entry)

Should-fix:
- security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id]
- history.ts converted to fs/promises (async /sessions handler)
- removed dead clientDims map + blur protocol message end-to-end
- per-connection WS message rate limit (Config.maxMsgsPerSec)
- /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7)

Tests:
- new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites
- extended history/config/manager/integration coverage incl. regressions

Hygiene:
- parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation
- log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped
- operational constants moved into Config
- extracted public/preview-grid.ts (DRY launcher/manage)
- doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments

test/manager.test.ts

@@ -46,6 +46,11 @@ const CFG: Config = {
   scrollbackBytes: 2 * 1024 * 1024,
   maxPayloadBytes: 1024 * 1024,
   wsPath: '/term',
+  maxSessions: 50,
+  maxMsgsPerSec: 2000,
+  permTimeoutMs: 300_000,
+  reapIntervalMs: 60_000,
+  previewBytes: 24 * 1024,
   useTmux: false,
   allowedOrigins: [],
 };
@@ -509,6 +514,105 @@ describe('shutdown', () => {
   });
 });
 
+// ── maxSessions DoS cap (Sec H1) ──────────────────────────────────────────────
+describe('handleAttach — session cap', () => {
+  it('throws once the table is at cfg.maxSessions (new-session path)', () => {
+    const cappedCfg: Config = { ...CFG, maxSessions: 2 };
+    const mgr = createSessionManager(cappedCfg);
+
+    nextPty = createMockPty();
+    mgr.handleAttach(createMockWs(), null, DIMS, 1_000);
+    nextPty = createMockPty();
+    mgr.handleAttach(createMockWs(), null, DIMS, 1_000);
+
+    // Third new session must be refused (reuses the M4 exit(-1) path in server).
+    nextPty = createMockPty();
+    expect(() => mgr.handleAttach(createMockWs(), null, DIMS, 1_000)).toThrow(/limit/i);
+  });
+
+  it('also caps the not-found path (unknown id → would create)', () => {
+    const cappedCfg: Config = { ...CFG, maxSessions: 1 };
+    const mgr = createSessionManager(cappedCfg);
+    mgr.handleAttach(createMockWs(), null, DIMS, 1_000);
+
+    const unknown = '00000000-0000-4000-8000-000000000099';
+    nextPty = createMockPty();
+    expect(() => mgr.handleAttach(createMockWs(), unknown, DIMS, 1_000)).toThrow(/limit/i);
+  });
+
+  it('JOINing an existing session does NOT count against the cap', () => {
+    const cappedCfg: Config = { ...CFG, maxSessions: 1 };
+    const mgr = createSessionManager(cappedCfg);
+    const s = mgr.handleAttach(createMockWs(), null, DIMS, 1_000);
+
+    // A second device joining the same session must be allowed at the cap.
+    expect(() => mgr.handleAttach(createMockWs(), s.meta.id, DIMS, 2_000)).not.toThrow();
+    expect(s.clients.size).toBe(2);
+  });
+});
+
+// ── killById (manage page) ────────────────────────────────────────────────────
+describe('killById', () => {
+  it('closes all clients, kills the PTY, and removes the session', () => {
+    const mgr = createSessionManager(CFG);
+    const a = createMockWs();
+    const b = createMockWs();
+    const s = mgr.handleAttach(a, null, DIMS, 1_000);
+    mgr.handleAttach(b, s.meta.id, DIMS, 2_000);
+
+    const ok = mgr.killById(s.meta.id);
+
+    expect(ok).toBe(true);
+    expect(a.closed).toBe(true);
+    expect(b.closed).toBe(true);
+    expect((s.pty as MockIPty).killed).toBe(true);
+    expect(mgr.get(s.meta.id)).toBeUndefined();
+  });
+
+  it('returns false for an unknown id', () => {
+    const mgr = createSessionManager(CFG);
+    expect(mgr.killById('00000000-0000-4000-8000-0000000000aa')).toBe(false);
+  });
+});
+
+// ── handleHookEvent (H2/H3 status push) ───────────────────────────────────────
+describe('handleHookEvent', () => {
+  it('sets claudeStatus and broadcasts a status frame to all clients', () => {
+    const mgr = createSessionManager(CFG);
+    const a = createMockWs();
+    const b = createMockWs();
+    const s = mgr.handleAttach(a, null, DIMS, 1_000);
+    mgr.handleAttach(b, s.meta.id, DIMS, 2_000);
+    a.sent.length = 0;
+    b.sent.length = 0;
+
+    mgr.handleHookEvent(s.meta.id, 'waiting', 'Bash', true);
+
+    expect(s.claudeStatus).toBe('waiting');
+    for (const ws of [a, b]) {
+      const status = parseSent(ws).find((m) => m.type === 'status');
+      expect(status).toMatchObject({ type: 'status', status: 'waiting', detail: 'Bash', pending: true });
+    }
+  });
+
+  it('omits detail/pending when not supplied', () => {
+    const mgr = createSessionManager(CFG);
+    const ws = createMockWs();
+    const s = mgr.handleAttach(ws, null, DIMS, 1_000);
+    ws.sent.length = 0;
+
+    mgr.handleHookEvent(s.meta.id, 'idle');
+
+    const status = parseSent(ws).find((m) => m.type === 'status');
+    expect(status).toEqual({ type: 'status', status: 'idle' });
+  });
+
+  it('is a no-op for an unknown session id', () => {
+    const mgr = createSessionManager(CFG);
+    expect(() => mgr.handleHookEvent('00000000-0000-4000-8000-0000000000bb', 'working')).not.toThrow();
+  });
+});
+
 // ── L2: injected onExit removes session when ws is attached at exit time ───────
 describe('onExit removes session from table when ws attached at exit time (L2)', () => {
   it('session is removed from the table when PTY exits while ws is attached', () => {