fix: code cleanup — path traversal, test leaks, dead code, consistency

- Add path traversal protection to GET /api/cases/:name and fix-plan
- Use safePathSchema for LinkCaseSchema.path
- Fix QR auth test timer leak (afterAll → afterEach) and env var try/finally
- Remove dead terminal size check after Zod validation in resize route
- Remove no-op sampleCount guard in adaptive timing
- Replace hardcoded values with constants in notification-manager and subagent-windows
- Add Zod validation to POST /api/auth/revoke
- Use _apiPut instead of raw fetch in subagent-windows
- Add SwipeHandler.cleanup() for consistency with other mobile handlers
- Move NiceConfig/ProcessStats from types/plan.ts to types/common.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/web/routes/case-routes.ts

@@ -162,6 +162,14 @@ export function registerCaseRoutes(app: FastifyInstance, ctx: EventPort & Config
   app.get('/api/cases/:name', async (req) => {
     const { name } = req.params as { name: string };
 
+    // Security: Path traversal protection
+    const resolvedPath = resolve(join(CASES_DIR, name));
+    const resolvedBase = resolve(CASES_DIR);
+    const relPath = relative(resolvedBase, resolvedPath);
+    if (relPath.startsWith('..') || isAbsolute(relPath)) {
+      return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid case name');
+    }
+
     // First check linked cases
     const linkedCasesFile = join(homedir(), '.codeman', 'linked-cases.json');
     try {
@@ -197,6 +205,14 @@ export function registerCaseRoutes(app: FastifyInstance, ctx: EventPort & Config
   app.get('/api/cases/:name/fix-plan', async (req) => {
     const { name } = req.params as { name: string };
 
+    // Security: Path traversal protection
+    const resolvedPath = resolve(join(CASES_DIR, name));
+    const resolvedBase = resolve(CASES_DIR);
+    const relPath = relative(resolvedBase, resolvedPath);
+    if (relPath.startsWith('..') || isAbsolute(relPath)) {
+      return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid case name');
+    }
+
     // Get case path (check linked cases first, then CASES_DIR)
     let casePath: string | null = null;