fix(web): harden scan lifecycle and runtime integrity

[h3zh1]

Summary

• make scan cancellation and timeout propagation terminal-safe across SQLite, the Hub, and remote agents
• reject invalid remote scan results and keep task failures isolated from the Hub process
• enforce SQLite session foreign keys, migrate legacy child tables, and reject writes to missing sessions
• subscribe SSE clients before reading snapshots so terminal scan and chat events cannot fall into a replay gap
• enforce exact multipart upload limits and cancel pending remote uploads when requests end
• stage, validate, and atomically commit configuration reloads while active scans retain leases on the old runtime
• restore tidy Go module metadata and run the terminal browser E2E suite against the production handler in CI

User-visible behavior

• canceling a queued or running scan now converges to one immutable terminal state and releases its concurrency slot
• missing scans return 404, while attempts to cancel completed or failed scans return 409
• completed, failed, and canceled scans are replayed immediately when an SSE client reconnects
• missing chat sessions no longer accept messages, uploads, or orphan AOP history
• oversized files return 413 instead of being silently truncated
• a failed configuration candidate leaves both the committed file and current runtime unchanged
• existing scans continue on the retired runtime until their final lease is released

Commit structure

1. fix(web): make scan cancellation terminal-safe
2. fix(web): reject invalid remote scan results
3. fix(web): enforce session referential integrity
4. fix(web): close SSE snapshot subscription gaps
5. fix(web): reject oversized multipart uploads
6. fix(web): make config reload transactional
7. chore(deps): restore tidy module metadata
8. test(web): run real browser terminal e2e

Deferred

The following findings remain intentionally out of scope for this PR:

• authoritative Hub-side AOP ordering and resumable SSE event IDs
• latest-history window semantics and cursor pagination

Verification

• go test ./pkg/web -short -count=1 -timeout=5m
• go test -race ./pkg/web -short -count=1 -timeout=5m
• go test -tags full ./cmd/aiscan -count=1 -timeout=5m
• go test ./... -count=1 -timeout=10m
• go vet ./...
• go mod tidy -diff
• npm --prefix web/frontend run build
• go test -race -tags e2e ./pkg/web -run '^TestE2ETerminal(OpenAndType|Resize)$'
• Windows amd64 full-package cross-compilation
• git diff --check

Dependency

This is stacked on #76 so the PR contains only the eight follow-up commits above. After #76 merges, this PR can be retargeted to master without changing its patch.