Squash-merges a chain of fixes prompted by post-#1418 user feedback on
the live web dashboard. The unifying themes: nothing should change
when you don't expect it to (token, port, URL, SSE stream), and
everything should give visible feedback when you do change it.

Server
- POST /api/sessions/new now echoes the new session name so the bridge
  can update state.currentSession without diffing the list.
- parseTranscript surfaces reasoning_content, tool_calls, and tool
  results (by tool_call_id) so historical replays show what the model
  actually did, not just the raw text turns.
- serveAsset injects ?token=... into CSS url() font references in
  addition to the existing JS-import rewrite — the previous gap 401'd
  every Geist / KaTeX font fetch.
- New /api/browse?path= lists immediate subdirectories (Windows drive
  letters included on first call) so the web runtime can ship a real
  directory picker.
- startDashboardServer exposes updateContext(ctx) — the handle now
  outlives a chat.tsx-driven App remount, and the new App rewires its
  loop/refs in place instead of forcing a port rebind that the OS
  hadn't released yet (EADDRINUSE -> ephemeral fallback -> new URL).
- Dashboard token + actual bound port are persisted to config.json on
  first run via ensureDashboardToken / saveDashboardPort, with an
  EADDRINUSE fallback to ephemeral. /dashboard reset-token rotates
  the token and restarts the server.

CLI
- listSessions workspace filter now reaches the dashboard's GET
  /api/sessions, cutting sidebar entries from "every subagent
  transcript on disk" (10 000+ for active users) down to the current
  workspace's chats.
- getDashboardUrl appends &session=<name> so the printed URL points
  at the attached session and survives copy/paste.

Dashboard UI
- Persistent module-level dashboardHandle + eventSubscribers Set so
  React App remounts (session swap) don't tear the server down and
  don't drop SSE subscribers on the floor — fixed the "send a message
  after switching, web stays silent" desync.
- session_load bridge handler emits $session_loaded with the new
  name and full segments (text + reasoning + tool calls stitched to
  results), instead of pushing an error card via $session_empty.
- Thread renders use index-based React keys for AssistantMsg —
  replayed transcripts arrive with turn=0 for every assistant row,
  so the turn-keyed list was collapsing every assistant message into
  one stale slot on every session switch.
- Sidebar gets a per-row loading spinner; thread shows a centered
  overlay during the swap so big sessions don't look dead.
- CSS containment on .session-item, .msg, and .thread; dropped a
  needless backdrop-filter on the loading overlay. Together these cut
  the Paint/Layout/pointerover budget noticeably on long transcripts.
- New WorkdirInputModal backed by /api/browse — the web build
  previously stub'd openDialog to "" so clicking Browse did nothing.
- Removed the "+ new tab" affordance from the tab bar (web has no
  multi-tab story).
- URL session mirror from #1586 reverted to read-on-mount only so
  clicking a session doesn't churn the address bar.

i18n
- statusbar.themeStyle{Graphite,Sandstone,Porcelain,Midnight}
- settings.themeStyle* + Desc, settings.page* Label + Desc for all 8
  pages, sidebarPanel.loading, workdir.{cancel,go,goTip,loading,
  emptyDir,openHere,pathPlaceholder}, handlers.dashboard.tokenReset*
  (en and zh-CN where relevant).

Tests
- tests/dashboard-token-persistence.test.ts (9 cases) for
  ensureDashboardToken / saveDashboardPort / clearDashboardToken.
- dashboard-sessions-ops gains coverage for the workspace filter
  and the new POST /sessions/new name echo.
- dashboard-smoke verifies CSS font url() token injection in
  addition to the existing JS chunk-import rewrite.