[0.9.1] FORK_IA_UX: review pass — remove dead code + Karvan security hardening

Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
  .hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
  .oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).

Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
  document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
  spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.

src/backend/backend.js

@@ -3655,7 +3655,13 @@ router
   .get('/karvan/:id', async (ctx) => {
     if (!checkMod(ctx, 'karvanMod')) { ctx.redirect('/modules'); return; }
     let room = karvanModel.getRoom(ctx.params.id);
-    if (!room) room = karvanModel.adoptRoom({ id: ctx.params.id }); // unirse por enlace/invitación (espejo local)
+    // unirse por enlace/invitación crea un espejo local, pero SOLO en una navegación real (documento):
+    // un <img>/subrecurso de una web maliciosa NO debe poder crear/expulsar salas por GET (CSRF). El navegador
+    // controla sec-fetch-dest/accept, así que son señales fiables.
+    if (!room) {
+      const isNav = ctx.get('sec-fetch-dest') === 'document' || (ctx.get('accept') || '').includes('text/html');
+      if (isNav) room = karvanModel.adoptRoom({ id: ctx.params.id });
+    }
     if (!room) { ctx.redirect('/karvan'); return; }
     let selfId = ''; try { selfId = getViewerId(); } catch (e) {}
     const msgs = karvanModel.listMessages(room.id, 0) || [];