batch3 T5 review fixes: backoff off-by-one + activeSession shape + headers

- useUserEvents: double delay before scheduling, producing 1/2/4/8/16/30s
- useSidebar: activeSessionProjectId -> activeSession {session_id,project_id}
  so consumers can verify URL match and ignore stale values
- api.panes.create/update: drop redundant Content-Type (request helper sets)
- useUserEvents: minimal type guard on incoming WS frame before emit

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/src/hooks/useUserEvents.ts

@@ -23,11 +23,10 @@ export function useUserEvents(): void {
 
       ws.onmessage = (ev) => {
         try {
-          const frame = JSON.parse(ev.data);
-          // The server emits frames whose `type` matches SessionEvent union members
-          // (project_created, project_deleted, session_created, session_deleted, session_updated).
-          // Pass through onto the bus.
-          sessionEvents.emit(frame);
+          const parsed: unknown = JSON.parse(ev.data);
+          if (parsed && typeof (parsed as { type?: unknown }).type === 'string') {
+            sessionEvents.emit(parsed as import('./sessionEvents').SessionEvent);
+          }
         } catch (err) {
           console.warn('useUserEvents: failed to parse frame', err);
         }
@@ -35,10 +34,9 @@ export function useUserEvents(): void {
 
       ws.onclose = () => {
         if (unmounted) return;
-        reconnectTimer = setTimeout(() => {
-          reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
-          connect();
-        }, reconnectDelay);
+        const delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
+        reconnectTimer = setTimeout(connect, delay);
       };
 
       ws.onerror = () => {