fix: bash command validation - catch JSON/Python/bare URLs before execution, prevent exit 127 confusion

feat: Qwen3 uncensored prompt + Manus-style UI + P0 bug fixes

Fix all 10 critical audit bugs:

fix: critical tool chain + planning + autonomy bugs

Full parity with original Rust: session validation, sandbox detection, remote proxy, hooks payload, LSP shutdown

fix: revert max_tokens to 16384 (output tokens, not context window)

feat: remove API settings tab, set default max tokens to 1M

feat: MCP tools dynamic injection into agent TOOL_DEFINITIONS

Major update: fix 400 error, 1M context, real Agent/PR/Issue, no auto-compact

Fix 400 error (tool_calls JSON parse), rewrite WebFetch/WebSearch 1:1 from original claw-code

fix: mobile responsive, max tokens 128k, HuggingFace models, Quick Select UI

Claw Web v1.0 — AI Agent Web Interface with MiMo-V2-Flash