feat: add WebSocket terminal with SDK InteractiveSession

[rhuss]

Summary

• WebSocket terminal handler bridging xterm.js to the SDK's Exec().Interactive() API
• Ticket-based auth (single-use, 30s TTL opaque tokens) instead of raw JWTs in URLs
• Origin validation, idle timeout, structured session logging, configurable shell command
• JetBrains Mono font with proper line height for clean terminal rendering

Changes

Backend (3 new files, 3 modified):

• ws_ticket.go / ws_ticket_test.go: In-memory ticket store with issuance, single-use validation, expiry cleanup, and max capacity (10k)
• terminal_handler.go / terminal_handler_test.go: WebSocket handler using SDK InteractiveSession (io.Reader/io.Writer), mutex-protected writes, idle timeout, close codes, origin validation tests
• app.go: Terminal route (outside auth group), ws-ticket route, idle timeout config
• main.go: -terminal-idle-timeout flag / TERMINAL_IDLE_TIMEOUT env var
• oidc.go: WithToken()/WithClaims() helpers for ticket-based context injection

Frontend (1 new file, 2 modified):

• terminal.ts: fetchWsTicket() API function
• SandboxTerminalTab.tsx: Ticket-based auth, sandbox phase pre-check, reconnect on error, JetBrains Mono font
• index.html: Google Fonts import for JetBrains Mono

Depends on

• PR refactor: migrate BFF from direct gRPC to openshell-sdk-go Gkrumbach07/openshell-dashboard#2 on upstream (SDK migration), merge that first

Test plan

• make test passes (16 Go tests + 13 frontend tests)
• make typecheck passes
• Deep review: 5 agents + CodeRabbit, all Critical/Important fixed
• Manual: terminal connects, commands work, resize works, exit shows code
• Ticket auth: single-use enforced, expired tickets rejected
• Origin validation: non-matching origins rejected
• Route fix: terminal route no longer shadows sandbox detail endpoint

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2aacbdf1-7dfc-46bf-94d3-64cce92bfacf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}