Client review fixes: bug fix, dead code, deduplication, CSS vars ...

- renderPreviewStrip: fix index-capture bug (splice by value, not index)
- api.js: remove dead sendMessage (messaging goes via WebSocket only)
- utils.js: extract shared esc() and timeLabel() from chat.js + sidebar.js
- enrichSession: remove unnecessary async/Promise.all wrapper
- style.css: thinking-card colors moved to CSS variables in :root
- WsClient: remove unused #sessionId field

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>