fix: code cleanup — path traversal, test leaks, dead code, consistency

- Add path traversal protection to GET /api/cases/:name and fix-plan
- Use safePathSchema for LinkCaseSchema.path
- Fix QR auth test timer leak (afterAll → afterEach) and env var try/finally
- Remove dead terminal size check after Zod validation in resize route
- Remove no-op sampleCount guard in adaptive timing
- Replace hardcoded values with constants in notification-manager and subagent-windows
- Add Zod validation to POST /api/auth/revoke
- Use _apiPut instead of raw fetch in subagent-windows
- Add SwipeHandler.cleanup() for consistency with other mobile handlers
- Move NiceConfig/ProcessStats from types/plan.ts to types/common.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/web/routes/system-routes.ts

@@ -19,6 +19,7 @@ import {
   CpuLimitSchema,
   SubagentWindowStatesSchema,
   SubagentParentMapSchema,
+  RevokeSessionSchema,
 } from '../schemas.js';
 import { subagentWatcher } from '../../subagent-watcher.js';
 import { imageWatcher } from '../../image-watcher.js';
@@ -194,9 +195,9 @@ export function registerSystemRoutes(
   // ========== Auth Session Revocation ==========
 
   app.post('/api/auth/revoke', async (req) => {
-    const body = req.body as { sessionToken?: string } | undefined;
-    if (body?.sessionToken) {
-      ctx.authSessions?.delete(body.sessionToken);
+    const result = RevokeSessionSchema.safeParse(req.body);
+    if (result.success && result.data.sessionToken) {
+      ctx.authSessions?.delete(result.data.sessionToken);
     } else {
       // Revoke all sessions (nuclear option)
       ctx.authSessions?.clear();