feat: add session replay with terminal playback via xterm.js

Persist byte-level I/O events from SSH sessions to SQLite and add a web
UI to replay them with original timing. Events are buffered in memory
and flushed every 2s to avoid blocking SSH I/O on database writes.

- Add session_events table (migration 002)
- Add SessionEvent type and storage methods (SQLite + MemoryStore)
- Change RecordingChannel to support multiple callbacks
- Add EventRecorder for buffered event persistence
- Add session detail page with xterm.js terminal replay
- Add /api/sessions/{id}/events JSON endpoint
- Linkify session IDs in dashboard and active sessions
- Vendor xterm.js v5.3.0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/web/web.go

@@ -2,7 +2,6 @@ package web
 
 import (
 	"embed"
-	"html/template"
 	"log/slog"
 	"net/http"
 
@@ -17,7 +16,7 @@ type Server struct {
 	store  storage.Store
 	logger *slog.Logger
 	mux    *http.ServeMux
-	tmpl   *template.Template
+	tmpl   *templateSet
 }
 
 // NewServer creates a new web Server with routes registered.
@@ -35,6 +34,8 @@ func NewServer(store storage.Store, logger *slog.Logger) (*Server, error) {
 	}
 
 	s.mux.Handle("GET /static/", http.FileServerFS(staticFS))
+	s.mux.HandleFunc("GET /sessions/{id}", s.handleSessionDetail)
+	s.mux.HandleFunc("GET /api/sessions/{id}/events", s.handleAPISessionEvents)
 	s.mux.HandleFunc("GET /", s.handleDashboard)
 	s.mux.HandleFunc("GET /fragments/stats", s.handleFragmentStats)
 	s.mux.HandleFunc("GET /fragments/active-sessions", s.handleFragmentActiveSessions)