fix: security hardening and cleanup from community PR cherry-picks

- Add HTML sanitizer for markdown rendering (XSS prevention)
- Switch service worker to network-first caching (deploys take effect immediately)
- Sanitize Content-Disposition filenames (header injection prevention)
- Expose session.muxName getter, replace unsafe `as any` cast
- Static import for execFile, update CLAUDE.md keyboard shortcuts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/web/routes/file-routes.ts

@@ -293,7 +293,9 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort): void
 
       const content = await fs.readFile(resolvedPath);
       if (download === 'true') {
-        const basename = filePath!.split('/').pop() || 'download';
+        const rawBasename = filePath!.split('/').pop() || 'download';
+        // Sanitize filename for Content-Disposition header (prevent header injection)
+        const basename = rawBasename.replace(/["\\\r\n]/g, '_');
         reply.raw.writeHead(200, {
           'Content-Type': mimeTypes[ext] || 'application/octet-stream',
           'Content-Disposition': `attachment; filename="${basename}"`,