feat(terminal): add bounded snapshot and history streaming

[Lint111]

Summary

Adds the server-side contracts for lossless, bounded terminal restoration and live delivery without loading an entire conversation into the browser.

• adds per-session stream/generation cursors to terminal output
• exposes raw compressed terminal snapshots with cursor metadata in response headers
• captures bounded tmux history pages asynchronously with stable row coordinates
• distinguishes an explicit empty SSE subscription from legacy unfiltered delivery
• coordinates SSE/WebSocket ownership for a per-tab terminal stream
• batches mobile output without splitting UTF-8, ANSI control strings, or synchronized updates
• carries cursor ranges across bounded WebSocket frames
• discards incomplete ANSI tails at clear, generation, and handoff boundaries

Commit Structure

1. fix(stream): distinguish empty terminal subscriptions
2. feat(terminal): add bounded snapshot and history streaming
3. fix(terminal): preserve cursor boundaries across websocket frames

Design Notes

GET /api/sessions/:id/terminal?format=stream returns terminal text outside the JSON envelope and places stream, generation, range, source, truncation, and status metadata in headers.

historyPage=1 captures one physical-row page from tmux. Capture uses asynchronous execFile calls, bounded output buffers, and argument arrays rather than a shell, so a history request does not block other sessions or accept shell interpolation.

Live SSE and WebSocket batches use the same UTF-16 cursor units as JavaScript string slicing. Clients can queue output during a snapshot and deterministically discard overlap instead of relying on empty-buffer heuristics.

This PR is server/transport infrastructure. It intentionally excludes browser frame covers, lazy history rendering, session restoration metadata, repository browsing, Codex animation settings, and mobile controls; those are reviewed separately.

Validation

• npm run build
• npm run typecheck
• npm run lint
• Prettier check for every changed source/test/document
• 162 focused tests across session routes, SSE filtering/batching, WebSocket transport, cursor handling, and tmux history paging

The repository-wide integration suite was not run in this active clone: its current cleanup path can delete the checkout itself. That isolation issue is tracked separately in #175; focused tests here use mocks/injected runners and cannot access the user's tmux server.

[Ark0N]

Hi Lior, closing this one as part of a cleanup of the seventeen PRs currently open from you. The full explanation is in #173, and I would rather you read that one than this note, because it is the honest version and it is not a dismissal of your work.

The short form: sixteen PRs opened in a single day, roughly 42,000 added lines in total, landing mostly on the same few files (nine touch app.js, eight touch terminal-ui.js), with five already conflicting against master and none carrying CI results. I cannot review that at the standard this codebase needs, and merging it at a lower standard would be worse than not merging it.

Going forward, please keep no more than three open PRs at a time, each one a single behavior change that stands on its own, with a test that fails on master and passes with the fix. #214 and #215, merged today, are good models.

If this particular change fixes something that genuinely annoys you in daily use, it is a good candidate to be the first one you reopen on its own, rebased on current master. I will review it properly.

Thanks for the effort you put in, and sorry to close it this way.