fix: address post-merge review findings from PR #17

[citizen-123]

Summary

Follow-up to #17 after an exhaustive multi-agent review found eight issue families in the merged implementation.

• sanitize decoded embedded JSON before terminal rendering, including C0/C1 controls in keys and values
• make VT shutdown race-free and restore shutdown lifecycle tests to race CI
• decouple emulator reply draining from stalled PTY writes with bounded, ordered buffering
• use native textarea wheel handling without moving editor insertion points
• route wheel input to Repeater Request and Payload editors
• preserve right-pane modal focus when the terminal pane is clicked
• redirect startup logs before configuration processing while preserving prior diagnostics
• replace sensitive session/export files atomically with owner-only POSIX modes and durable directory updates

Review process

Each issue was implemented in an isolated worktree and reviewed by independent agents. Review blockers triggered additional regression tests and fix rounds. Two final whole-branch reviewers approved the integrated result with no actionable findings.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• go build ./...
• Windows amd64 cross-compilation
• Darwin arm64 cross-compilation
• git diff --check

All checks pass after merging current main (de54dd9).