feat: Claude CLI 2.1.50–2.1.53 audit (#171)

## Summary

This PR covers the full audit of Claude CLI changes from 2.1.50 to 2.1.53, plus a batch of bug fixes, new features, and maintenance work identified during that review.

### New Features
- **Workspace trust gate** — detects hooks, MCP servers, and custom commands in a workspace before connecting; persists trust decisions so users aren't prompted repeatedly
- **Custom background image** — users can set a background image with configurable opacity; character panel and compact mode go transparent when active
- **Draggable tab reordering** — conversation tabs can be reordered via pointer-event drag-and-drop (HTML5 drag is intercepted by Tauri/WebView2, so pointer events are used instead)
- **Org UUID in account info** — exposes the org UUID from Claude auth status

### Bug Fixes
- **Unread dot false positives** — initialise unread counts on mount to prevent all tabs showing the blue dot after toggling the file editor (Closes #164)
- **Watchdog for hung WSL bridge** — detects connections that never receive `system:init` and kills the stale process after 1 minute (Closes #166)
- **Suppress terminal window flash on Windows** — applies `CREATE_NO_WINDOW` to all subprocesses via a `HideWindow` trait extension (Closes #165)
- **HTML escaping in markdown renderer** — escape `<` and `>` in `codespan` and `html` renderer callbacks to prevent raw HTML injection (Closes #169)

### Maintenance
- Verify stream-JSON handles tool results above the 50K threshold correctly (Closes #162)
- Reviewed hook security fixes from CLI 2.1.51 — not applicable to our setup (Closes #163)
- Expose org UUID from `claude auth status` (Closes #160)
- Clean up Svelte and Vite build warnings (`a11y_click_events_have_key_events`, `state_referenced_locally`, `non_reactive_update`, `codeSplitting`, chunk size, CodeMirror dynamic import)
- Update all npm dependencies to latest compatible versions with exact pinning (Closes #81, Closes #82, Closes #83, Closes #84, Closes #85, Closes #86, Closes #87, Closes #90, Closes #91, Closes #93, Closes #94, Closes #95, Closes #96, Closes #97, Closes #98, Closes #99, Closes #101, Closes #141, Closes #142, Closes #143, Closes #145, Closes #146, Closes #147)
- Run `cargo update` to bring Cargo.lock up to date

### Closes

Closes #160
Closes #162
Closes #163
Closes #164
Closes #165
Closes #166
Closes #167
Closes #168
Closes #169
Closes #81
Closes #82
Closes #83
Closes #84
Closes #85
Closes #86
Closes #87
Closes #90
Closes #91
Closes #93
Closes #94
Closes #95
Closes #96
Closes #97
Closes #98
Closes #99
Closes #101
Closes #141
Closes #142
Closes #143
Closes #145
Closes #146
Closes #147

✨ This PR was created with help from Hikari~ 🌸

Reviewed-on: #171
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

src-tauri/src/config.rs

@@ -125,6 +125,16 @@ pub struct HikariConfig {
 
     #[serde(default)]
     pub disable_1m_context: bool,
+
+    #[serde(default)]
+    pub trusted_workspaces: Vec<String>,
+
+    // Background image settings
+    #[serde(default)]
+    pub background_image_path: Option<String>,
+
+    #[serde(default = "default_background_image_opacity")]
+    pub background_image_opacity: f32,
 }
 
 impl Default for HikariConfig {
@@ -159,6 +169,9 @@ impl Default for HikariConfig {
             discord_rpc_enabled: true,
             use_worktree: false,
             disable_1m_context: false,
+            trusted_workspaces: Vec::new(),
+            background_image_path: None,
+            background_image_opacity: 0.3,
         }
     }
 }
@@ -195,6 +208,10 @@ fn default_discord_rpc_enabled() -> bool {
     true
 }
 
+fn default_background_image_opacity() -> f32 {
+    0.3
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
 #[serde(rename_all = "lowercase")]
 pub enum BudgetAction {
@@ -268,6 +285,7 @@ mod tests {
         assert!(config.discord_rpc_enabled);
         assert!(!config.use_worktree);
         assert!(!config.disable_1m_context);
+        assert!(config.trusted_workspaces.is_empty());
     }
 
     #[test]
@@ -302,6 +320,9 @@ mod tests {
             discord_rpc_enabled: true,
             use_worktree: true,
             disable_1m_context: false,
+            trusted_workspaces: vec!["/home/naomi/projects/trusted".to_string()],
+            background_image_path: Some("/home/naomi/bg.png".to_string()),
+            background_image_opacity: 0.25,
         };
 
         let json = serde_json::to_string(&config).unwrap();