feat: cherry-pick keyboard UX and file download from community PRs

Cherry-picked from PR #60 (keyboard UX) and PR #61 (file download):

- Alt+1-9 session switching
- Disable Ctrl+K (too easy to trigger accidentally)
- Session rename with prefix preservation (w1-case: description)
- Shift+Enter / Ctrl+Enter multiline input via tmux send-keys -H
- Android virtual keyboard fix for non-composition input
- File download button in browser file explorer (?download=true)

Dropped from PR #60: stale package-lock.json, upload popup (missing upload.html)
Dropped from PR #61: standalone /api/download endpoint (arbitrary fs access)
Fixed from PR #60: execFileSync replaced with async execFile

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/web/routes/file-routes.ts

@@ -239,7 +239,7 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort): void
   // Serve raw file content (for images/binary files)
   app.get('/api/sessions/:id/file-raw', async (req, reply) => {
     const { id } = req.params as { id: string };
-    const { path: filePath } = req.query as { path?: string };
+    const { path: filePath, download } = req.query as { path?: string; download?: string };
     const session = findSessionOrFail(ctx, id);
 
     if (!filePath) {
@@ -292,6 +292,16 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort): void
       };
 
       const content = await fs.readFile(resolvedPath);
+      if (download === 'true') {
+        const basename = filePath!.split('/').pop() || 'download';
+        reply.raw.writeHead(200, {
+          'Content-Type': mimeTypes[ext] || 'application/octet-stream',
+          'Content-Disposition': `attachment; filename="${basename}"`,
+          'Content-Length': content.length,
+        });
+        reply.raw.end(content);
+        return;
+      }
       reply.header('Content-Type', mimeTypes[ext] || 'application/octet-stream');
       reply.send(content);
     } catch (err) {

src/web/routes/session-routes.ts

@@ -524,6 +524,47 @@ export function registerSessionRoutes(
     return { success: true };
   });
 
+  // ========== Send Named Key (tmux send-keys -H) ==========
+  // Sends raw hex bytes to tmux pane for keys like Shift+Enter / Ctrl+Enter.
+  // Uses send-keys -H (hex) to inject 0x0a (line feed) which Claude Code's
+  // Ink input recognizes as "insert newline" vs 0x0d (carriage return = submit).
+
+  app.post('/api/sessions/:id/send-key', async (req): Promise<ApiResponse> => {
+    const { id } = req.params as { id: string };
+    const body = req.body as Record<string, unknown>;
+    const key = typeof body?.key === 'string' ? body.key : '';
+
+    // Map key names to hex byte sequences
+    const KEY_HEX_MAP: Record<string, string[]> = {
+      'S-Enter': ['0a'], // \n (line feed)
+      'C-Enter': ['0a'], // \n (line feed)
+    };
+    const hex = KEY_HEX_MAP[key];
+    if (!hex) {
+      return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Key not allowed: ${key}`);
+    }
+
+    const session = findSessionOrFail(ctx, id);
+    const muxName = (session as any)._muxSession?.muxName;
+    if (!muxName) {
+      return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'No tmux session');
+    }
+
+    try {
+      const { execFile } = await import('child_process');
+      await new Promise<void>((resolve, reject) => {
+        execFile('tmux', ['send-keys', '-H', '-t', muxName, ...hex], { timeout: 5000 }, (err) => {
+          if (err) reject(err);
+          else resolve();
+        });
+      });
+    } catch (err) {
+      console.error('[Server] send-key failed:', err);
+      return createErrorResponse(ApiErrorCode.INTERNAL_ERROR, 'tmux send-keys failed');
+    }
+    return { success: true };
+  });
+
   // ========== Resize Terminal ==========
 
   app.post('/api/sessions/:id/resize', async (req): Promise<ApiResponse> => {