fix: complete all remaining production hardening fixes

- Fix stale closures: sessionRef syncs with session state, sendMessage uses sessionRef.current
- Add rate limiting: 500ms debounce on user input prevents double-send
- Add settings migration system: v1→v2 migration with version tracking
- Fix unifiedDiff: proper LCS-based diff using dynamic programming with fallback for large files
- Wire up clearSessionFiles: called on /compact to prevent memory leak
- Fix DuckDuckGo scraping: multiple URL fallbacks, multiple snippet patterns, graceful degradation
- Add streaming state to orchestration commands (setIsStreaming/setMood on start/complete/error)
- Improve token estimation: code vs text differentiation, tool call overhead, system prompt overhead

All 10 remaining audit items addressed.

Author: thegreatalxx

dist/sessions/manager.d.ts.map

@@ -19,6 +19,9 @@ export declare class ToolExecutor {
     getSessionFiles(): Record<string, string>;
     undoLastChange(): string | null;
     unifiedDiff(filePath: string): string | null;
+    private computeLCS;
+    private computeLCSFallback;
+    private lcsToChanges;
     /**
      * Clear tracked session files to free memory.
      * Call this after a session is saved or compacted.