feat(web): let humans discard finished sessions

[lenucksi]

Problem

Finished (exited/killed) sessions could never be removed from the web UI. The only action was Kill Session, which intentionally retains the session and its buffer (cleanup = false), so the session list grew forever. Other open tabs only noticed a removal via the 10s polling sync.

Changes

• Sidebar is grouped into Running / Finished sections. Running rows get a Kill action, finished rows get a Remove action, and the finished section gets a Clear finished bulk action. Finished rows are dimmed and show their exit status.
• Output header gets Download (exports the raw buffer as a .log) plus either Kill Session (running) or Remove (finished).
• Removal is human-only. Killing keeps the session and its buffer for log access; removing frees the buffer and drops the session from the list. The PTY tools keep the existing cleanup flag but document it as deprecated, so agents can kill a session but do not discard finished ones.
• Live sync: a new session_removed WebSocket message is broadcast on cleanup/clear, so every open client updates immediately instead of waiting for the 10s poll.

Also fixes a build trap

The client styles lived in an inline <style> block in index.html, while src/web/client/index.css was dead code that nothing imported. CSS edits therefore silently had no effect (the built CSS asset was only xterm.css). Styles now live in index.css, imported from main.tsx, and the inline block is gone.

Verification

• bun run format, bun run lint, bun run typecheck — clean
• bun test — new tests cover the session_removed broadcast, the cleanup endpoint, and retain-on-kill. The remaining failures are pre-existing on main (npm-pack asset tests + two timing-sensitive tests).
• New Playwright e2e test for the remove flow (runs in CI here).

Screenshot