feat(tui): add web server auto-start, shell mode, and feature parity

TUI now checks if web server is running on startup and offers to start
it in the background. Added new CLI options: --with-web (auto-start),
--no-web (skip check), -p (port).

TUI feature parity with web interface:
- Shell mode: press 'h' in cases view to start bash instead of Claude
- Multi-start: press 'm' to start 1-20 sessions at once
- Respawn toggle: Ctrl+R to enable/disable respawn on Claude sessions
- Session rename: API support via useSessionManager hook

Security fixes from previous analysis:
- Command injection prevention in screen-manager.ts
- Path traversal protection in server.ts
- Input validation for shell-interpolated values

Also fixes memory leak in session.ts (timer tracking) and flaky test
timeout in session-cleanup.test.ts.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/cli.ts

@@ -483,10 +483,18 @@ program
 program
   .command('tui')
   .description('Start the terminal user interface')
-  .action(async () => {
+  .option('--with-web', 'Automatically start the web server if not running (no prompt)')
+  .option('--no-web', 'Skip web server check entirely')
+  .option('-p, --port <port>', 'Web server port (default: 3000)', '3000')
+  .action(async (options: { withWeb?: boolean; web?: boolean; port?: string }) => {
     try {
       const { startTUI } = await import('./tui/index.js');
-      await startTUI();
+      const port = parseInt(options.port || '3000', 10);
+      await startTUI({
+        autoStartWeb: options.withWeb || false,
+        skipWebCheck: options.web === false,
+        port,
+      });
     } catch (err) {
       console.error(chalk.red(`✗ Failed to start TUI: ${(err as Error).message}`));
       process.exit(1);