feat(web): xterm.js terminal dock + front-end QA pass

Replaces the floating REPL drawer with a docked terminal, and fixes the
usability problems a screenshot audit of the console turned up.

Terminal (the reason for the change):

- The drawer rendered the harness into a <div>, so the server had to strip
  ANSI before sending it: colour, the box-drawn /status panel and the banner
  all arrived flattened, and long lines rewrapped mid-glyph. The stream is now
  sent verbatim and rendered by xterm.js (vendored, nothing fetched at
  runtime), decoded with a streaming UTF-8 decoder so a multi-byte character
  split across two reads survives.
- The drawer floated bottom-right, directly over "Next →" and "Start
  Exploitation" — the wizard's primary buttons. The dock is a flex child of
  .main, so opening it shortens the view instead of covering it. Drag its top
  edge to resize; the height is remembered.
- The child is spawned over a pipe, not a PTY, so it never echoes: line
  editing is local — echo, ←/→, Home/End, history, Tab completion over the
  slash commands, Ctrl+C/L/U/K/A/E. Ctrl-C is delivered as SIGINT by the
  server, since a raw 0x03 byte over a pipe interrupts nothing.
- A target picker switches the terminal between a standalone REPL session and
  the engagement currently running, so mid-run instructions go to the same
  process doing the testing.

QA fixes:

- Findings tables sorted by severity (a LOW above a CRITICAL made a 27-row
  result unreadable), with sortable headers, a severity summary that doubles
  as a filter, a text filter, a sticky header, and horizontal scroll confined
  to the table instead of the whole page.
- alert()/prompt() replaced by inline field errors, a custom-lead modal and
  toasts — a modal alert hid the very field it was complaining about.
- Lead categories start collapsed (412 leads over ~30 categories); search
  auto-expands what it matches and shows per-category hit counts.
- Sidebar rows truncate inside the rail (a long target URL used to spill past
  its border), and carry a worst-severity dot, finding count and age.
- Past-run header shows when it ran, how many agents ran, the recon asset,
  PoC count and run id — two runs of one target were indistinguishable.
- Off-canvas sidebar below 768px had no way to be opened; added the toggle.
- Long evidence values (cookies, tokens) now wrap instead of running under
  the finding modal's edge.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvdGy9XtVWSdXDTa3FFLJv

web/API.md

@@ -233,7 +233,11 @@ Starts a session. Response: `{ "id": "<session-uuid>" }`.
 
 ### `POST /api/repl/:id/input`
 
-Body: `{ "line": "/status" }`. Writes `line + "\n"` to the child's stdin.
+Body: `{ "line": "/status" }` — writes `line + "\n"` to the child's stdin — or `{ "data": "..." }`
+to write bytes verbatim (what the browser terminal sends, newline included). A `data` payload
+containing `\u0003` (Ctrl-C) is delivered as `SIGINT` to the child instead of being written:
+without a tty in between, nothing else turns that byte into an interrupt. Responds `409` once the
+session's stdin has closed.
 
 ### `POST /api/repl/:id/stop`
 
@@ -243,11 +247,12 @@ Sends `SIGTERM` to the session's child process.
 
 | event   | data                    | meaning |
 |---------|-------------------------|---------|
-| `data`  | `{ "chunk": "..." }`   | raw stdout/stderr chunk (ANSI stripped), not line-buffered |
+| `data`  | `{ "chunk": "..." }`   | raw stdout/stderr chunk, ANSI **preserved**, not line-buffered |
 | `close` | `{}`                    | child process exited |
 
-Replays the session's buffered output (capped at the last 5000 chunks) on connect, same as the
-exploit stream.
+Replays the session's buffered output (capped at the last ~512 KB) on connect, same as the exploit
+stream. Chunks are decoded with a streaming UTF-8 decoder, so a multi-byte character split across
+two reads still arrives intact — the browser feeds them straight into xterm.js.
 
 ---