feat(sidebar): order sessions by latest activity; make live sessions stand out

[alari76]

Why

With many sessions open, the recently active ones get buried — rows were in creation order, and the 6px green dot is easy to miss.

What

• Ordering: sessions within each repo sort by latest activity — newest turn first, sessions mid-turn pinned on top. Selecting/viewing a session does not reorder it.
• Server: new persisted lastTurnAt on sessions, set when a turn starts (sendInput) and finishes (handleClaudeResult), exposed on SessionInfo. (The existing lastActivity is bumped on client join and reset on restart, so it isn't usable for ordering.) Sessions without it fall back to created.
• Visibility: running and waiting dots are larger with a soft halo; the row gets a faint success/warning tint; the meta line says working / queued / needs you instead of an age.
• Age: idle rows now show time since last activity (tooltip: "Last active 5m ago · started 3d ago").

Repo groups stay alphabetical.

Tests

• src/lib/sessionOrder.test.ts — ordering, running-first, bad timestamps
• RepoSection.test.tsx — activity age + live labels
• Full suite: the only failures are the 4 in server/utility-agent.test.ts, which fail on main too (local environment)

🤖 Generated with Claude Code

[alari76]

CI fix (run #1741): the Audit dependencies step failed. New advisories had come out for transitive dependencies; nothing in this PR's code caused it. I ran npm audit fix in both / and server/, which only changes the lockfiles: proxy-addr 2.0.7→2.0.8 (critical), @modelcontextprotocol/sdk 1.30.0→1.32.1 (high), hono 4.13.5→4.13.13 (moderate). npm audit --audit-level=high is now clean in both. The build passes and the test suite is unchanged.

[alari76]

CI run #1743 failure — already resolved, no further push needed

The "Audit dependencies" step failed on two newly published advisories in transitive dev dependencies:

• dompurify <=3.4.15 (GHSA-p98j-92pf-mc4p, GHSA-6688-9rhm-gjv2) — locked at 3.4.13
• source-map-js 1.2.1 (high, GHSA-68fv-2mgg-jv7q) — in both the root and server/ lockfiles

I prepared a lockfile bump (dompurify → 3.4.17, source-map-js → 1.2.2), but in the meantime this branch was rebased onto main, which now includes #711 with exactly those versions (plus the proxy-addr / MCP SDK / hono bumps). I dropped my duplicate commit rather than push it. The current head 80ab084 passed CI on Node 20 and 22, including the audit step (run 38358714885).

🤖 Generated with Claude Code