v0.8.2: build fixes, WebUI security and correctness

Build: <fcntl.h> in tui.c, format-truncation in http_srv.c and /web.

WebUI:
- refuse cross-site requests (Origin must be the page itself) in the
  default no-token mode: any page could POST approval=yolo and a prompt
- session/workspace/undo/compact/attach/model changes are 409 while a
  turn runs (use-after-free, messages landing in the wrong session)
- ask_user returned "dismissed" at once instead of waiting
- cancel and shutdown wake a turn parked on a permission or question;
  SIGTERM mid-turn no longer hangs or crashes
- a page opened while a question is pending still gets it;
  Last-Event-ID resumes the stream; event seq matches the SSE id
- token mode: page assets load without the token, images via cookie
- --web-open works, --web-port/--web-token are validated
- frontend: gate keys ignored while typing, clear-images button,
  reasoning no longer wiped while streaming

HTTP server: auth and size cap before reading the body, strict
Content-Length, NUL in url_decode, 413 on keep-alive, idle timeout,
absolute-form only without a leading '/', case-insensitive Connection,
header deadline, 400 for long request lines, unlink before close,
poll() instead of select(), SO_EXCLUSIVEADDRUSE on Windows.

Markdown sanitizer escapes quotes in attribute values.

/web: passes this session's provider/model/base/effort/approval (key
via the environment), keeps output off the TUI, shows the real URL and
keeps CURRENT on the TUI's session.

Tests: scripts/e2e_webui_ask.py, scripts/e2e_webui_http.py (run from
e2e_webui.sh), sanitizer quote test.

tests/test_webui.c

@@ -236,6 +236,16 @@ static void test_sanitize(void) {
   CHECK(strstr(html, "<a") == NULL); /* an unusable href drops the tag */
   free(html);
 
+  /* a quote inside a single-quoted or bare value cannot open a new attribute */
+  const char *quoted = "<a href='http://x\" onmouseover=\"alert(1)'>q</a>"
+                       "<a href=http://y\"onmouseover=alert(2)//>r</a>";
+  html = cst_web_md_sanitize(quoted, strlen(quoted));
+  CHECK(html != NULL);
+  CHECK(strstr(html, "\" onmouseover") == NULL);
+  CHECK(strstr(html, "\"onmouseover") == NULL);
+  CHECK(strstr(html, "&quot;") != NULL);
+  free(html);
+
   /* streaming: a javascript: link is dropped, a split tag never leaks */
   {
     cst_buf_free(&g_md_out);