fix: code cleanup — path traversal, test leaks, dead code, consistency

- Add path traversal protection to GET /api/cases/:name and fix-plan
- Use safePathSchema for LinkCaseSchema.path
- Fix QR auth test timer leak (afterAll → afterEach) and env var try/finally
- Remove dead terminal size check after Zod validation in resize route
- Remove no-op sampleCount guard in adaptive timing
- Replace hardcoded values with constants in notification-manager and subagent-windows
- Add Zod validation to POST /api/auth/revoke
- Use _apiPut instead of raw fetch in subagent-windows
- Add SwipeHandler.cleanup() for consistency with other mobile handlers
- Move NiceConfig/ProcessStats from types/plan.ts to types/common.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/web/routes/session-routes.ts

@@ -43,8 +43,6 @@ import { RunSummaryTracker } from '../../run-summary.js';
 
 import {
   MAX_INPUT_LENGTH,
-  MAX_TERMINAL_COLS,
-  MAX_TERMINAL_ROWS,
   MAX_SESSION_NAME_LENGTH,
 } from '../../config/terminal-limits.js';
 
@@ -495,14 +493,6 @@ export function registerSessionRoutes(
       return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Session not found');
     }
 
-    // Note: Zod already validates that cols and rows are positive integers within bounds
-    if (cols > MAX_TERMINAL_COLS || rows > MAX_TERMINAL_ROWS) {
-      return createErrorResponse(
-        ApiErrorCode.INVALID_INPUT,
-        `Terminal dimensions exceed maximum (${MAX_TERMINAL_COLS}x${MAX_TERMINAL_ROWS})`
-      );
-    }
-
     session.resize(cols, rows);
     return { success: true };
   });