COD-134 fix WS flap loop (undefined onopen call) + reconnect resilience + logging

Root cause of the WS->HTTP->WS flapping: the v1.1.15 input-delivery merge left a
call to the now-undefined _flushHttpFallbackQueuesViaWs() in ws.onopen, so every
(re)connect threw a TypeError BEFORE _onWsReady() ran -- durable input was never
re-flushed over the fresh socket, the 2s redeliver sweep then saw stale unacked
frames and force-closed the socket, reconnect, throw again: a self-sustaining
flap loop. Remove the dead call (_onWsReady, 10 lines below, is its replacement).

Resilience + observability:
- Pure CodemanWsReconnect.plan(code, attempt) (constants.js, TDD, 6 tests):
  <4004 -> fast reconnect (immediate jittered first retry, faster backoff);
  4008/unknown->=4004 -> bounded retry-fallback (HTTP no longer sticks until a
  tab switch); 4004/4009 -> give up (session gone). Wired into onclose.
- Redeliver sweep force-closes only a SILENT socket (no recent recv), not one
  actively delivering output/ACKs -- stops self-inflicted flaps while typing.
- Client logs WS close code/reason to crash-diag; server logs [ws]
  open/close/terminate/4008 (console -> journald; Fastify runs logger:false).

Verified: 6/6 unit, tsc 0, frontend-syntax + prettier clean, build; beta WS
reaches connected with zero console errors (onopen TypeError gone),
_wsLastRecvAt tracked, server [ws] lines emit.

src/web/routes/ws-routes.ts

@@ -83,13 +83,19 @@ export function registerWsRoutes(app: FastifyInstance, ctx: SessionPort, getHost
       return;
     }
 
+    // Structured transport logging — surfaces WS open/close/timeout churn so the
+    // tunnel-flap behavior (COD-134) is observable in the server logs. Fastify is
+    // configured logger:false, so we log via console (→ journald under systemd).
+
     // Enforce per-session connection limit
     const currentCount = sessionWsCount.get(id) ?? 0;
     if (currentCount >= MAX_WS_PER_SESSION) {
+      console.warn('[ws] terminal rejected: too many connections', { sessionId: id, wsCount: currentCount });
       socket.close(4008, 'Too many connections');
       return;
     }
     sessionWsCount.set(id, currentCount + 1);
+    console.info('[ws] terminal open', { sessionId: id, wsCount: currentCount + 1 });
 
     // Swallow socket errors — cleanup happens in 'close'
     socket.on('error', () => {});
@@ -228,11 +234,12 @@ export function registerWsRoutes(app: FastifyInstance, ctx: SessionPort, getHost
       if (socket.readyState !== 1) return;
       socket.ping();
       pongTimeout = setTimeout(() => {
+        console.warn('[ws] terminal ping timeout — terminating', { sessionId: id });
         socket.terminate();
       }, WS_PONG_TIMEOUT_MS);
     }, WS_PING_INTERVAL_MS);
 
-    socket.on('close', () => {
+    socket.on('close', (code: number, reason: Buffer) => {
       clearInterval(pingInterval);
       if (pongTimeout) clearTimeout(pongTimeout);
       if (batchTimer) clearTimeout(batchTimer);
@@ -245,11 +252,13 @@ export function registerWsRoutes(app: FastifyInstance, ctx: SessionPort, getHost
 
       // Decrement per-session connection count
       const count = sessionWsCount.get(id) ?? 1;
-      if (count <= 1) {
+      const remaining = count <= 1 ? 0 : count - 1;
+      if (remaining === 0) {
         sessionWsCount.delete(id);
       } else {
-        sessionWsCount.set(id, count - 1);
+        sessionWsCount.set(id, remaining);
       }
+      console.info('[ws] terminal close', { sessionId: id, code, reason: String(reason), wsCount: remaining });
     });
   });
 }