fix: address review report across security, architecture, quality, tests

Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review).
typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage
thresholds (80%) enforced in vitest.config.ts.

Critical:
- multi-device approval race: release held approval only when the last
  client detaches (closing one mirror no longer cancels another's prompt)
- unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS),
  enforced in manager via the existing M4 exit(-1) path
- signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close()
- terminal-session initialInput timer tracked + cleared on dispose
- tabs.addEntry null-as-cast type hole removed (build session before entry)

Should-fix:
- security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id]
- history.ts converted to fs/promises (async /sessions handler)
- removed dead clientDims map + blur protocol message end-to-end
- per-connection WS message rate limit (Config.maxMsgsPerSec)
- /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7)

Tests:
- new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites
- extended history/config/manager/integration coverage incl. regressions

Hygiene:
- parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation
- log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped
- operational constants moved into Config
- extracted public/preview-grid.ts (DRY launcher/manage)
- doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments

test/session.test.ts

@@ -33,7 +33,7 @@ vi.mock('node-pty', () => ({
 }));
 
 // Imported AFTER vi.mock so the module under test binds to the mocked spawn.
-const { createSession, attachWs, detachWs, writeInput, setClientDims, clearClientDims, kill } =
+const { createSession, attachWs, detachWs, writeInput, setClientDims, kill } =
   await import('../src/session/session.js');
 
 // ── helpers ─────────────────────────────────────────────────────────────────
@@ -46,6 +46,11 @@ const CFG: Config = {
   scrollbackBytes: 2 * 1024 * 1024,
   maxPayloadBytes: 1024 * 1024,
   wsPath: '/term',
+  maxSessions: 50,
+  maxMsgsPerSec: 2000,
+  permTimeoutMs: 300_000,
+  reapIntervalMs: 60_000,
+  previewBytes: 24 * 1024,
   useTmux: false,
   allowedOrigins: [],
 };
@@ -241,18 +246,6 @@ describe('attachWs', () => {
     expect(s.pty.rows).toBe(50);
   });
 
-  it('clearClientDims (tab hidden) does NOT resize — the active device keeps its size', () => {
-    const s = newSession();
-    const a = createMockWs();
-    const b = createMockWs();
-    setClientDims(s, a, 200, 50);
-    setClientDims(s, b, 90, 30); // b is using it now → 90x30
-
-    clearClientDims(s, a); // a's tab hidden elsewhere → just forget a's dims
-    // PTY unchanged: b is still the active viewer at 90x30.
-    expect(s.pty.cols).toBe(90);
-    expect(s.pty.rows).toBe(30);
-  });
 });
 
 // ── detachWs (remove one client) ──────────────────────────────────────────────