Close P0/P1 cluster test gaps from test-review audit

[NickCrew]

Description

test-review-request flagged critical/important missing coverage around no-secret authorization paths and validation boundaries in cluster.ts. Add focused tests (and small refactors if needed) to cover the highest-risk cases.

Acceptance Criteria

• Close P0/P1 cluster test gaps from test-review audit #1 No-secret mode is tested for loopback-bind accept behavior and non-loopback-bind reject behavior.
• Add automated tests for HUD overlay stats, persistence, and keyboard drag behavior #2 Validation tests cover non-http(s) protocol rejection, malformed/public IP target rejection, and future timestamp rejection.
• Refactor HUD overlay into smaller hooks/components and reduce hardcoded geometry #3 Rate validation tests cover clamping/truncation and invalid values (0, negative, NaN, Infinity).

---

Migrated from backlog TASK-5 (Apparatus).