test: cover tmux parsing and session API edge cases

[ivanxgb]

Add focused tests around the pieces that should stay stable as the project grows.

Useful targets:

• tmux list-sessions/list-windows/list-panes parser fixtures
• empty tmux output
• malformed tmux lines
• session create/rename/delete handler validation
• friendly errors when tmux is not installed or no server is running

This is a good first issue because it can start with small table-driven Go tests.

[ivanxgb]

Started this in cd7f397 with focused Go coverage for:

• auth refresh cookie/body behavior
• WebSocket origin allowlist defaults
• tmux session/window/pane parser fixtures

Still open for broader session API handler tests and e2e coverage around a real tmux process.