fix: address review report across security, architecture, quality, tests

Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review).
typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage
thresholds (80%) enforced in vitest.config.ts.

Critical:
- multi-device approval race: release held approval only when the last
  client detaches (closing one mirror no longer cancels another's prompt)
- unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS),
  enforced in manager via the existing M4 exit(-1) path
- signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close()
- terminal-session initialInput timer tracked + cleared on dispose
- tabs.addEntry null-as-cast type hole removed (build session before entry)

Should-fix:
- security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id]
- history.ts converted to fs/promises (async /sessions handler)
- removed dead clientDims map + blur protocol message end-to-end
- per-connection WS message rate limit (Config.maxMsgsPerSec)
- /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7)

Tests:
- new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites
- extended history/config/manager/integration coverage incl. regressions

Hygiene:
- parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation
- log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped
- operational constants moved into Config
- extracted public/preview-grid.ts (DRY launcher/manage)
- doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments

test/tmux.test.ts

@@ -0,0 +1,70 @@
+/**
+ * test/tmux.test.ts (H1) — thin tmux CLI wrappers.
+ *
+ * execFileSync is mocked so no real tmux binary runs: every wrapper is
+ * best-effort and must NOT throw (a throwing exec → false / no-op).
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const mockExec = vi.fn()
+vi.mock('node:child_process', () => ({
+  execFileSync: (...a: unknown[]) => mockExec(...a),
+}))
+
+const { tmuxAvailable, tmuxName, hasSession, killSession } = await import('../src/session/tmux.js')
+
+beforeEach(() => {
+  mockExec.mockReset()
+})
+
+describe('tmuxName', () => {
+  it('prefixes the session id with web_', () => {
+    expect(tmuxName('abc')).toBe('web_abc')
+  })
+})
+
+describe('tmuxAvailable', () => {
+  it('returns true when `tmux -V` succeeds', () => {
+    mockExec.mockReturnValue(Buffer.from('tmux 3.4'))
+    expect(tmuxAvailable()).toBe(true)
+    expect(mockExec).toHaveBeenCalledWith('tmux', ['-V'], { stdio: 'ignore' })
+  })
+
+  it('returns false when tmux is missing (exec throws)', () => {
+    mockExec.mockImplementation(() => {
+      throw new Error('ENOENT')
+    })
+    expect(tmuxAvailable()).toBe(false)
+  })
+})
+
+describe('hasSession', () => {
+  it('returns true when has-session exits 0', () => {
+    mockExec.mockReturnValue(Buffer.from(''))
+    expect(hasSession('web_x')).toBe(true)
+    expect(mockExec).toHaveBeenCalledWith('tmux', ['has-session', '-t', 'web_x'], { stdio: 'ignore' })
+  })
+
+  it('returns false when has-session throws (no such session)', () => {
+    mockExec.mockImplementation(() => {
+      throw new Error("can't find session")
+    })
+    expect(hasSession('web_gone')).toBe(false)
+  })
+})
+
+describe('killSession', () => {
+  it('invokes tmux kill-session for the name', () => {
+    mockExec.mockReturnValue(Buffer.from(''))
+    killSession('web_x')
+    expect(mockExec).toHaveBeenCalledWith('tmux', ['kill-session', '-t', 'web_x'], { stdio: 'ignore' })
+  })
+
+  it('swallows errors when the session is already gone', () => {
+    mockExec.mockImplementation(() => {
+      throw new Error('no session')
+    })
+    expect(() => killSession('web_gone')).not.toThrow()
+  })
+})