terminal-focus: capture __CFBundleIdentifier (+ hostname, tmux socket) for robust identity

[JayantDevkar]

Follow-ups from the PR #86/#87 terminal-focus work — capture-side improvements to resolve_terminal() in hooks/live_session_tracker.py and their consumers in api/services/terminal_focus.py:

• __CFBundleIdentifier — macOS sets it in every GUI-descended process (com.apple.Terminal, com.microsoft.VSCode, Cursor's own id). Activating via tell application id "..." instead of display name fixes: Cursor masquerading as VS Code (TERM_PROGRAM=vscode → raises the wrong app), the localized-app-name resolution hazard, and collapses the _MAC_APP_NAMES mapping table.
• hostname — pid/tty/window-id are machine-local; if live-session state files ever sync across machines (Syncthing), can_focus should require the captured hostname to match the API host instead of relying on the pid-liveness gate accidentally protecting.
• tmux socket path — $TMUX contains socket_path,pid,session; today only a boolean is stored, so non-default-socket tmux servers get commands aimed at the wrong server. Store the path and pass -S.

Also worth a look while in there: hook-side unit tests for resolve_terminal() and the backfill branch (currently untested), and extending the CSRF origin guard to the pre-existing DELETE /{id} / POST /cleanup* endpoints.

🤖 Generated with Claude Code