feat: session management sidebar + Zustand persist

[aterrylu]

Summary

• Session sidebar — left panel listing all active sessions with green status dot, age indicator, and kill button (hover to reveal). "+" button creates new sessions.
• Auto-reconnect — sessionId persisted via Zustand persist middleware. Page refresh reconnects to the last active session. If the server lost it, sidebar clears automatically.
• Zustand as single source of truth (ADR-011) — all client state lives in one store with persist middleware. No more scattered localStorage calls. partialize explicitly declares what survives a refresh.
• Mobile/Tailscale fixes — Vite binds to 0.0.0.0, dark body background prevents white flash, scrollbar styles scoped to terminal only.

┌─────────────────────────────────────────┐
│              Header                     │
├──────────┬──────────────────────────────┤
│ Sessions │       Terminal               │
│ ● Sess 1 │                              │
│ ○ Sess 2 │                              │
│   [+]    │                              │
└──────────┴──────────────────────────────┘

Test plan

• Create multiple sessions via "+" button
• Click between sessions — terminal switches cleanly
• Refresh page — reconnects to last active session
• Kill a session — removed from sidebar, terminal clears if active
• Kill all sessions — shows "Create or select a session" placeholder
• Access from phone via Tailscale IP — sidebar and terminal render correctly
• Theme switching still works across all 3 themes
• Rapid "+" clicks don't create duplicate sessions (spawn guard)

🤖 Generated with Claude Code

[nox-0x]

status is never reset to a normal value after a successful createSession call. The flow sets status: "spawning..." at the start but only resets it on failure paths — the success path ends at set({ sessionId: session.id }) and fetchSessions() without clearing the status.

Consequence: isSpawning stays true indefinitely, permanently disabling the "+" button after the first session is created. Users cannot create a second session without a full page refresh.

Fix: add a status reset on success, e.g.:

const session: SessionInfo = await res.json();
set({ sessionId: session.id, status: "connected" });
await get().fetchSessions();

[aterrylu]

Fixed in 8027528 — added status: "connected" to the success path. Good catch, this would have been a show-stopper after the first session.

[nox-0x]

Nested <button> inside <button> is invalid HTML — the spec forbids interactive content inside <button>. Browsers may "fix" the DOM by ejecting the inner button, which can cause the kill button to render outside the session row and break the hover-reveal behavior.

The standard fix is to replace the outer <button> with a <div> (styled with role="button" and tabIndex={0} for a11y) or restructure so the kill button is a sibling rather than a child:

<div
  role="button"
  tabIndex={0}
  className="group flex w-full ..."
  onClick={() => switchSession(s.id)}
  onKeyDown={(e) => e.key === "Enter" && switchSession(s.id)}
>
  {/* ... */}
  <button type="button" onClick={(e) => { e.stopPropagation(); killSession(s.id); }}>x</button>
</div>

In practice Chromium handles the nesting gracefully today, but it is a latent rendering bug.

[aterrylu]

Fixed in 8027528 — replaced the outer <button> with div[role=button] + tabIndex={0} + onKeyDown handler. The kill button is now a proper child of a non-interactive container.

[nox-0x]

Solid feature overall — the Zustand persist refactor is clean, the sidebar UX is well thought out, and the auto-reconnect on refresh is a nice touch. Two issues to fix before merge:

1. createSession status never resets on success (store.ts:153) — isSpawning stays true indefinitely after the first session is created, permanently disabling the "+" button until a page refresh. One-liner fix: add status: "connected" to the success set().

2. Nested <button> inside <button> (Sidebar.tsx:89) — spec violation; replace the outer <button> with a div[role=button] to avoid browser DOM fixup surprises with the hover-reveal kill button.

The status bug is the blocker — fix that and this is good to go.

[nox-0x]

Both issues from the previous review are addressed in 8027528: the spawning status now resets to 'connected' on success (fixing the permanently-disabled '+' button), and the outer button is replaced with div[role=button] (fixing the nested interactive element). The Zustand persist migration is solid — partialize is explicit, merge validates the theme, and transient state is correctly excluded. LGTM.