fix(electrobun): address all 22 Codex review #2 findings

CRITICAL:
- DocsTab XSS: DOMPurify sanitization on all {@html} output
- File RPC path traversal: guardPath() validates against project CWDs

HIGH:
- SSH injection: spawn /usr/bin/ssh via PTY args, no shell string
- Search XSS: strip HTML, highlight matches client-side with <mark>
- Terminal listener leak: cleanup functions stored + called in onDestroy
- FileBrowser race: request token, discard stale responses
- SearchOverlay race: same request token pattern
- App startup ordering: groups.list chains into active_group restore
- PtyClient timeout: 5-second auth timeout on connect()
- Rule 55: 6 {#if} patterns converted to style:display toggle

MEDIUM:
- Agent persistence: only persist NEW messages (lastPersistedIndex)
- Search errors: typed error response, "Invalid query" UI
- Health store wired: agent events call recordActivity/setProjectStatus
- index.ts SRP: split into 8 domain handler modules (298 lines)
- App.svelte: extracted workspace-store.svelte.ts
- rpc.ts: typed AppRpcHandle, removed `any`

LOW:
- CommandPalette listener wired in App.svelte
- Dead code removed (removeGroup, onDragStart, plugin loaded)

ui-electrobun/src/bun/handlers/search-handlers.ts

@@ -0,0 +1,41 @@
+/**
+ * Search RPC handlers — FTS5 full-text search.
+ * Fix #13: Returns typed error for invalid queries.
+ */
+
+import type { SearchDb } from "../search-db.ts";
+
+export function createSearchHandlers(searchDb: SearchDb) {
+  return {
+    "search.query": ({ query, limit }: { query: string; limit?: number }) => {
+      try {
+        const results = searchDb.searchAll(query, limit ?? 20);
+        return { results };
+      } catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        console.error("[search.query]", err);
+        return { results: [], error };
+      }
+    },
+
+    "search.indexMessage": ({ sessionId, role, content }: { sessionId: string; role: string; content: string }) => {
+      try {
+        searchDb.indexMessage(sessionId, role, content);
+        return { ok: true };
+      } catch (err) {
+        console.error("[search.indexMessage]", err);
+        return { ok: false };
+      }
+    },
+
+    "search.rebuild": () => {
+      try {
+        searchDb.rebuildIndex();
+        return { ok: true };
+      } catch (err) {
+        console.error("[search.rebuild]", err);
+        return { ok: false };
+      }
+    },
+  };
+}