fix(ui): hover-panic on non-ASCII links, paste and clipboard spoofing, image budget, links

- is_web_url sliced the string at byte 7/8, panicking (and killing every
  session) when a remote host printed an OSC 8 or plain link with a
  multi-byte character at that offset and the user hovered it. It now
  compares bytes.
- Paste confirmation also triggers on control characters other than tab
  (readline's C-o runs a line with no newline), and the preview shows
  them escaped.
- Remote clipboard toasts escape control characters and state the line
  count, so 'ls\ncurl … | sh' no longer reads as a harmless 'ls'.
- Inline images: dimensions are read from the header first and anything
  over the 32 Mpx per-terminal budget is refused before decoding.
- Toasts: repeats extend the visible toast and at most 8 are kept, so
  trigger or OSC 52 floods can't stall frames.
- The URL regex is compiled once.
- Enable eframe's 'links' feature: without it every 'open in browser'
  (Cmd/Ctrl+click, GitHub repo links, the update link) was a silent
  no-op. Adds webbrowser 1.2.4 to the lockfile.

rust/app/src/state.rs

@@ -45,6 +45,8 @@ pub enum SettingsTab {
     About,
 }
 
+const MAX_TOASTS: usize = 8;
+
 pub struct Toast {
     pub text: String,
     pub kind: ToastKind,
@@ -129,8 +131,17 @@ impl Shared {
     }
 
     fn push(&mut self, text: impl Into<String>, kind: ToastKind) {
-        let secs = if kind == ToastKind::Error { 6.0 } else { 4.0 };
-        self.toasts.push(Toast { text: text.into(), kind, until: self.now + secs });
+        let (text, secs) = (text.into(), if kind == ToastKind::Error { 6.0 } else { 4.0 });
+        // Remote output can raise toasts (triggers, clipboard writes) at line rate: repeats only
+        // extend the visible one, and at most a handful are kept so a flood can't stall frames.
+        if let Some(t) = self.toasts.iter_mut().find(|t| t.text == text && t.kind == kind) {
+            t.until = self.now + secs;
+        } else {
+            self.toasts.push(Toast { text, kind, until: self.now + secs });
+            if self.toasts.len() > MAX_TOASTS {
+                self.toasts.remove(0);
+            }
+        }
         self.ctx.request_repaint();
     }