Add test coverage (smoke + security)

[sudiptadeb]

Context

Zero Go tests today. Fine for a hobby v1 but the project is shaping up to have real users.

Suggested first cut

Small, focused, no framework:

• RingBuffer unit tests (session.go) — wraparound, exact-size writes, partial reads.
• Session lifecycle — spawn /bin/sh -c 'echo hi; exit 0', assert output, assert Done() fires, assert exit code.
• Dead-session revival — kill PTY, reattach, assert scrollback replay from disk + new shell spawn in saved cwd.
• Security middleware (main.go) — Host-header allowlist, Origin allowlist, CORS echo behavior, security headers present.
• ID regex — accept valid 32-hex IDs, reject ../etc/passwd, reject empty, reject over-length.
• Handler happy path — tabs CRUD over HTTP.

Not in scope now

• WebSocket integration tests (fiddly; defer).
• Browser-level E2E.

Also: once tests exist, add the go test ./... step to .github/workflows/build.yml.