Refactor: address complexity audit findings across 7 hotspots

[alari76]

Summary

• Merge duplicated groupKey: LeftSidebar.tsx now imports from useSessionOrchestration instead of re-implementing locally
• Deduplicate auto-approve logic: extracted resolveAutoApproval() in SessionManager, replacing two copy-pasted blocks in wireClaudeEvents and requestToolApproval
• Extract uploadAndBuildMessage: shared utility in ccApi.ts eliminates duplicated upload+fileLine construction in handleSendWithFiles and handleExecuteTentative
• Flatten content_block_stop: extracted handleThinkingBlockStop() and handleToolBlockStop() from the branchy switch case in claude-process.ts
• Lift listRuns SQL to query builder: added typed buildListQuery() helper in workflow-engine.ts for safer, reusable parameterized queries
• Break wireClaudeEvents into named handlers: 13 inline closures → named private methods + broadcastAndHistory helper in session-manager.ts
• Extract handleWsMessage: new ws-message-handler.ts module with typed WsHandlerContext, making the 12-case switch unit-testable without a real WebSocket
• Audit report fixes: clarified metrics, added line ranges to nesting claims, reframed contradictory summary, reworded SQL injection claim

Net: -431 lines removed, +495 added (including new module). Overall line count reduced by ~70 lines across existing files.

Test plan

• All 855 tests pass (33 test files)
• TypeScript strict-mode type check passes
• Production build succeeds
• Manual smoke test: create session, send message, tool approval flow, tentative queue

🤖 Generated with Claude Code