refactor(api): split monolithic handlers.go into focused modules

Break down the 627-line handlers.go into specialized modules:
- handlers_chat.go: chat and streaming endpoints
- handlers_config.go: configuration endpoints
- handlers_common.go: shared utilities
- handlers_info.go: info and status endpoints
- handlers_terminal.go: terminal/shell endpoints
- handlers_tools.go: tool-related endpoints

Also includes config improvements, orchestrator enhancements, and
web component updates.

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

internal/api/terminal.go

@@ -18,7 +18,23 @@ import (
 )
 
 var upgrader = websocket.Upgrader{
-	CheckOrigin: func(r *http.Request) bool { return true },
+	CheckOrigin: func(r *http.Request) bool {
+		origin := r.Header.Get("Origin")
+		if origin == "" {
+			return true
+		}
+		switch {
+		case strings.HasPrefix(origin, "http://127.0.0.1"),
+			strings.HasPrefix(origin, "http://localhost"),
+			strings.HasPrefix(origin, "http://[::1]"),
+			strings.HasPrefix(origin, "https://127.0.0.1"),
+			strings.HasPrefix(origin, "https://localhost"),
+			strings.HasPrefix(origin, "https://[::1]"):
+			return true
+		default:
+			return false
+		}
+	},
 }
 
 type wsMessage struct {
@@ -232,6 +248,10 @@ func (s *Server) handleTerminalSessions(w http.ResponseWriter, r *http.Request)
 }
 
 func (s *Server) handleTerminalSessionsDelete(w http.ResponseWriter, r *http.Request) {
+	if r.Method != "DELETE" {
+		writeError(w, "DELETE only", http.StatusMethodNotAllowed)
+		return
+	}
 	name := strings.TrimPrefix(r.URL.Path, "/api/terminal/sessions/")
 	if name == "" {
 		writeError(w, "name required", http.StatusBadRequest)