refactor: unify terminal transport

[steipete]

Summary

• Route browser, CLI, session-agent, and SSH-gateway managed terminal traffic through /api/terminal/ws.
• Remove direct session PTY routes and raw client transport; expose only the Worker-owned hub URL.
• Add one shared Go framing client with output acknowledgements, plus updated tests and docs.

Verification

• go test ./...
• go vet ./...
• go build -trimpath -o /tmp/crabfleet ./cmd/crabfleet
• go build -trimpath -o /tmp/crabbox-ssh-gateway ./cmd/crabbox-ssh-gateway
• docker build -f Dockerfile.ssh-gateway .
• pnpm check
• pnpm test
• pnpm build
• Codex autoreview: clean, no accepted/actionable findings

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: refactor: unify terminal transport This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.