v0.8.2: build fixes, WebUI security and correctness

Build: <fcntl.h> in tui.c, format-truncation in http_srv.c and /web.

WebUI:
- refuse cross-site requests (Origin must be the page itself) in the
  default no-token mode: any page could POST approval=yolo and a prompt
- session/workspace/undo/compact/attach/model changes are 409 while a
  turn runs (use-after-free, messages landing in the wrong session)
- ask_user returned "dismissed" at once instead of waiting
- cancel and shutdown wake a turn parked on a permission or question;
  SIGTERM mid-turn no longer hangs or crashes
- a page opened while a question is pending still gets it;
  Last-Event-ID resumes the stream; event seq matches the SSE id
- token mode: page assets load without the token, images via cookie
- --web-open works, --web-port/--web-token are validated
- frontend: gate keys ignored while typing, clear-images button,
  reasoning no longer wiped while streaming

HTTP server: auth and size cap before reading the body, strict
Content-Length, NUL in url_decode, 413 on keep-alive, idle timeout,
absolute-form only without a leading '/', case-insensitive Connection,
header deadline, 400 for long request lines, unlink before close,
poll() instead of select(), SO_EXCLUSIVEADDRUSE on Windows.

Markdown sanitizer escapes quotes in attribute values.

/web: passes this session's provider/model/base/effort/approval (key
via the environment), keeps output off the TUI, shows the real URL and
keeps CURRENT on the TUI's session.

Tests: scripts/e2e_webui_ask.py, scripts/e2e_webui_http.py (run from
e2e_webui.sh), sanitizer quote test.

src/main.c

@@ -255,6 +255,16 @@ static int demo_ctl_impl(const char *workspace) {
   return 0;
 }
 
+/* 0..65535, digits only: atoi turned "70000" into port 4464, "abc" into 0. */
+static int parse_port(const char *s, int *out) {
+  char *end = NULL;
+  long v = strtol(s, &end, 10);
+  if (!s[0] || *end || v < 0 || v > 65535)
+    return -1;
+  *out = (int)v;
+  return 0;
+}
+
 int main(int argc, char **argv) {
   if (os_console_init() != 0)
     fprintf(stderr, "warning: the process code page is not UTF-8 (Windows 10 "
@@ -334,8 +344,10 @@ int main(int argc, char **argv) {
   memset(&web, 0, sizeof(web));
   web.port = CST_WEBUI_DEFAULT_PORT; /* 0 would mean "pick a free one" */
   const char *env = getenv("CST_WEB_PORT");
-  if (env && env[0])
-    web.port = atoi(env);
+  if (env && env[0] && parse_port(env, &web.port) != 0) {
+    fprintf(stderr, "CST_WEB_PORT=%s is not a port (0-65535)\n", env);
+    return 1;
+  }
   web.host = getenv("CST_WEB_HOST");
   web.token = getenv("CST_WEB_TOKEN");
   web.root = getenv("CST_WEB_ROOT");
@@ -482,7 +494,11 @@ int main(int argc, char **argv) {
       web_mode = 1;
       break;
     case 0x102:
-      web.port = atoi(optarg);
+      if (parse_port(optarg, &web.port) != 0) {
+        fprintf(stderr, "--web-port %s is not a port (0-65535)\n", optarg);
+        curl_global_cleanup();
+        return 1;
+      }
       web_mode = 1;
       break;
     case 0x103: