Refactor: extract shared utilities, fix handler leak, accessibility

[finedesignz]

Summary

• Fix handler leak in Layout.tsx — subscribe() was called every render without cleanup, accumulating handlers unboundedly. Moved into useEffect with proper cleanup return.
• Extract shared crypto utilities — generateSecureToken() and hashToken() moved to hub/src/lib/crypto.ts. Removes 3 duplicate token-generation functions and fixes layering violation where hashToken lived in ws/channel.ts but was imported by 3 unrelated API files.
• Extract hubFetch utility — Created web/src/lib/api.ts with HUB_URL, authHeaders(), hubFetch(). Replaces ~30 repetitive lines across 5 hook files.
• Fix profile PATCH response — Was returning { ok: true }, causing client to clobber profile state. Now returns full profile object.
• Fix Infinity serialization — TIER_LIMITS.max was Infinity (serializes as null in JSON). Changed to -1 sentinel with proper limit checks.
• Parallelize DB queries — Independent tier/session-count queries in sessions.ts and plugin.ts now use Promise.all.
• Move TIER_LIMITS to config.ts — Was defined in profile.ts but imported cross-module.
• Wrap hook mutations in useCallback — Prevents unnecessary re-renders downstream.
• Fix accessibility — Sidebar action <span> elements changed to <button type="button"> for keyboard accessibility.
• Deduplicate App.tsx — Extracted LoadingScreen, removed redundant goToChat, collapsed duplicate Layout renders.

Test plan

• Verify hub starts without import errors
• Verify web type-checks cleanly (tsc --noEmit)
• Test session creation/deletion still works
• Test API key generation/revocation
• Test channel connection/auth flow
• Verify Layout doesn't accumulate handlers on re-render
• Verify profile update reflects in UI immediately

🤖 Generated with Claude Code