Security: ANSI sanitization and symlink protection

[iamtoruk]

Two gaps to close:

1. ANSI escapes in session JSONL render raw in the dashboard. Add strip-ansi to displayed strings.

2. Walk functions (providers/claude.ts) don't check for symlinks. Use lstat, skip symbolic links.