fix(host-console): audit session lifecycle and harden path, resize, and route gating (#1263)

* fix(host-console): audit session lifecycle and harden path, resize, and route gating

Record an audit-log entry when a host console session opens and when it
closes (capturing user, node, client IP, and timestamp), so interactive
host-shell access leaves a durable, accountable trail instead of only an
ephemeral log line.

Fix a stack-path boundary check that allowed a sibling directory sharing
the base path's prefix to pass; directory resolution now uses the
canonical within-base check via a small testable helper.

Validate terminal resize frames (positive integers within a sane bound)
before forwarding them to the PTY, dropping malformed frames instead of
passing them through.

Mirror the backend admin-only console permission on the frontend route so
a non-admin who reaches the view cannot mount a console the server would
reject, and log (rather than silently swallow) a working-directory
resolution failure.

Add unit coverage for the path helper, audit open/close rows, resize
validation, and the spawn-error path, plus a WebSocket-upgrade integration
test exercising the full gate chain and a live session-open audit row.

* fix(host-console): record the node the shell actually runs in

When the requested node's directory cannot be resolved, the session falls
back to the default node's base directory. Record that fallback node in the
session audit row (and log it) so the audit trail names the node the shell
actually runs in rather than the originally requested one. Strengthen the
upgrade integration test to assert the open row captures the user, node, and
client IP.

frontend/src/components/EditorLayout/ViewRouter.tsx

@@ -1,5 +1,6 @@
 import { Suspense, lazy, type ReactNode } from 'react';
 import { Skeleton } from '@/components/ui/skeleton';
+import { useAuth } from '@/context/AuthContext';
 import { AdmiralGate } from '../AdmiralGate';
 import { CapabilityGate } from '../CapabilityGate';
 import { HubOnlyGate } from '../HubOnlyGate';
@@ -105,6 +106,7 @@ export function ViewRouter({
     onClearNotifications,
     renderEditor,
 }: ViewRouterProps): ReactNode {
+    const { can } = useAuth();
     if (activeView === 'settings') {
         return (
             <SettingsPage
@@ -120,6 +122,10 @@ export function ViewRouter({
         return <ResourcesView />;
     }
     if (activeView === 'host-console') {
+        // Mirror the backend RBAC gate (system:console, admin-only). The nav
+        // item is already admin-gated; this stops a non-admin who reaches the
+        // view another way from mounting a console that the server will 403.
+        if (!can('system:console')) return null;
         return (
             <AdmiralGate>
                 <CapabilityGate capability="host-console" featureName="Host Console">