batch3 T5 review fixes: backoff off-by-one + activeSession shape + headers

- useUserEvents: double delay before scheduling, producing 1/2/4/8/16/30s
- useSidebar: activeSessionProjectId -> activeSession {session_id,project_id}
  so consumers can verify URL match and ignore stale values
- api.panes.create/update: drop redundant Content-Type (request helper sets)
- useUserEvents: minimal type guard on incoming WS frame before emit

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/src/api/client.ts

@@ -123,13 +123,11 @@ export const api = {
     create: (sessionId: string, body: PaneCreateRequest) =>
       request<Pane>(`/api/sessions/${sessionId}/panes`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),
       }),
     update: (id: string, body: PaneUpdateRequest) =>
       request<Pane>(`/api/panes/${id}`, {
         method: 'PATCH',
-        headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),
       }),
     remove: (id: string) =>