fix(host-console): harden with security fixes, validation, and test coverage (#580)

Security:
- Enforce RBAC (system:console permission) on WebSocket upgrade
- Validate token_version for user sessions on WS connections
- Expand env var sanitization to cover additional secret patterns
  (PRIVATE, AUTH, PASSPHRASE, ENCRYPT, SIGNING) and connection
  strings (REDIS_URL, MONGO_URI, AMQP_URL, DSN)

Reliability:
- Add session tracking with max 5 concurrent console sessions
- Add WebSocket heartbeat (30s ping, 60s pong timeout) to detect
  and clean up dead connections and orphaned PTY processes
- Differentiate PTY spawn error messages (shell not found,
  permission denied, generic failure)
- Guard against duplicate cleanup when both WS close and PTY exit
  fire

Observability:
- Add structured logging with [HostConsole] prefix for session
  lifecycle (open, close, duration, user, pid)
- Add diagnostic logging behind developer_mode for terminal resize
  events and message parse errors

Frontend:
- Replace hardcoded hex colors with oklch CSS custom properties
  (--terminal-bg, --terminal-fg, --terminal-cursor, etc.)
- Apply design system material tokens (shadow-card-bevel, recessed
  well shadow, card border hierarchy, strokeWidth 1.5)

Tests:
- Add 20 tests covering env sanitization patterns (10 keyword
  categories + safe vars + case insensitivity), session tracking,
  and console-token RBAC (admin, viewer, deployer, API tokens)

Docs:
- Document admin role requirement and session limits
- Add troubleshooting section (session limits, shell not found,
  proxy timeouts, missing console tab)
- Update security section with expanded env var coverage

frontend/src/index.css

@@ -142,6 +142,13 @@
 
   --tracking-normal: 0em;
   --spacing: 0.25rem;
+
+  /* Terminal (dark well even in light theme) */
+  --terminal-bg: oklch(0.12 0 0);
+  --terminal-fg: oklch(0.85 0 0);
+  --terminal-cursor: oklch(1 0 0);
+  --terminal-cursor-accent: oklch(0 0 0);
+  --terminal-selection: oklch(1 0 0 / 0.3);
 }
 
 /* ─────────────────────────────────────────────────────────────
@@ -271,6 +278,10 @@
   --shadow-lg: 0px 4px 6px -1px hsl(0 0% 0% / 0.15);
   --shadow-xl: 0px 8px 10px -1px hsl(0 0% 0% / 0.20);
   --shadow-2xl: 0px 12px 20px -2px hsl(0 0% 0% / 0.30);
+
+  /* Terminal (recessed well, matches page background)
+     --terminal-fg/cursor/selection: inherited from :root (both themes use a dark terminal) */
+  --terminal-bg: oklch(0.08 0 0);
 }
 
 /* ─────────────────────────────────────────────────────────────