fix(tui): harden TUI surface — markup escape, audit + rate-limit, bounded context

[CryptoJones]

Re-targeted onto v0.2.0 (supersedes #42). v0.2.0 never touched tui/app.py or assistant.py, so all of these were still live; the guard wiring is adapted to v0.2.0's reworked tasks.py/security.py.

Still-live issues fixed

• Untrusted page titles are rendered as Rich markup in the tab bar (MarkupError / style injection) #14 markup injection — _refresh_tabbar now escapes the page title, so [2026] Best [GPU] deals is shown literally instead of raising MarkupError or injecting styling.
• TUI constructs AuditLogger but never calls record() — entire surface is unaudited #19 / Background monitor probes bypass the TokenBucket — unmetered API/web calls #16 unaudited & unmetered TUI/tasks — new security.RequestGuard pairs the rate limiter with the audit log. The TUI commands/assist path and the background /task probes now go through it, so the TUI is audited and background watches are metered (a RateLimitError just counts as a probe failure toward v0.2.0's give-up threshold). The MCP server keeps its own inline guard (with correlation ids) untouched.
• TaskManager.aclose()/remove() cancel tasks without awaiting them — shutdown race with closed clients #18 shutdown race — TaskManager.aclose() awaits the cancelled probe handles before returning, so quitting doesn't race on_unmount closing the shared fetcher/client.
• Per-turn prompt context is unbounded: all open tabs re-sent every message, /space reloads every tab ever saved #21 unbounded context — only the most-recent few open tabs are sent as assistant context.
• _cmd_search runs two independent API round trips sequentially #32 sequential round-trips — /search runs its two independent calls via asyncio.gather(return_exceptions=True), so a failure in one no longer orphans the other.
• /task handler re-encodes valid task kinds as a tuple with a type: ignore instead of TaskManager validating TaskKind #33 duplicated task kinds — /task derives valid kinds from get_args(TaskKind).
• group_tabs: schema-nonconforming model JSON raises uncaught instead of graceful fallback #17 group_tabs crash — absorbs a malformed/non-conforming model response instead of raising.

Tests (113 passed, +6)

RequestGuard audit + rate-limit; guard-metered probe; aclose awaits an in-flight probe; tab-bar escaping a bracketed title; /search surfacing an error without crashing. ruff + mypy --strict clean, coverage 89.5%.

Supersedes #42.

🤖 Generated with Claude Code