fix(web-ui): surface core session limit

[john-the-dev]

Summary

A simple web UI question can sit in working even when the task bridge and web UI are healthy if sutando-core is blocked by Claude Code's session limit. Today /tasks/active reports claude: true based only on the process existing, so the UI looks alive but gives no reason that replies are queued.

This PR surfaces that blocked state:

• agent-api.py detects the Claude Code pane text You've hit your session limit ... resets ... from the sutando-core tmux session.
• /tasks/active includes core_limit for the dashboard status line.
• /core-status overrides the status step with Claude session limit reached; resets ... while the core is quota-blocked.
• The web UI shows that message instead of only brain offline / Core: working.

Why

Live repro on 2026-06-30: a web UI task are you able to create video? was created at 09:08:03 PDT and stayed working for several minutes. The core pane showed:

You've hit your session limit - resets 9:50am (America/Los_Angeles)

The UI had no way to communicate that reset time.

Test plan

• python3 tests/agent-api-core-limit.test.py
• npx tsx --test tests/web-client-core-limit-status.test.ts
• python3 -m py_compile src/agent-api.py tests/agent-api-core-limit.test.py
• npm run typecheck
• git diff --check

Notes

This does not bypass the Claude session limit. It only makes the blocked state visible so queued web UI tasks do not look like mysterious silence.

[john-the-dev]

Added browser verification screenshot for the session-limit UI state.

Test setup:

• Ran this PR branch's web UI on an isolated IPv6 loopback address (http://[::1]:18080/).
• Served a controlled agent-api fixture on http://[::1]:7843 returning:
  • /core-status -> core_limit.limited=true, reset 9:50am (America/Los_Angeles)
  • /tasks/active -> one queued web task: are you able to create video?
• Verified the dashboard renders the persistent status bar text: Core: Claude session limit reached; resets 9:50am (America/Los_Angeles) and shows the queued task under Tasks.

Screenshot:

[bassilkhilo-ag2]

✅ Clean. detect_core_session_limit() handles both typographic and straight apostrophe in the session-limit string, 0.75s tmux timeout is safe, triple-call dedup (status file + /core-status + /tasks/active) is right. Tests cover both positive and negative cases. Approve.

[bassilkhilo-ag2]

Good approach for surfacing an otherwise-invisible failure mode. The 0.75s timeout on tmux capture-pane is tight enough to not block the /core-status poll, and the regex covers both straight apostrophe and Unicode right-single-quote (the form Claude Code renders). Injecting core_limit into the core-status response is non-breaking since callers that do not expect the field will ignore it. The three code paths (status file exists + parseable, exists + unreadable, missing) all get the same augmentation. ✓

[bassilkhilo-ag2]

Solid approach. The regex handles both smart and straight apostrophes, the 0.75s tmux timeout is fail-open (except Exception: text = ''), and the core_limit field is correctly propagated through /core-status and /tasks. UX improvement: users see the reset time instead of a spurious 'brain offline'. LGTM.