[0.9.1] FORK_IA_UX: review pass — remove dead code + Karvan security hardening

Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
  .hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
  .oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).

Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
  document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
  spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.

src/client/public/js/karvan.js

@@ -255,6 +255,7 @@
     var pc = peer.pc;
     if (payload.kind === "desc") {
       var desc = payload.desc;
+      if (!desc) return;                 // señal malformada (sin desc) — no reventar el lote de sondeo
       var collision = desc.type === "offer" && (peer.makingOffer || pc.signalingState !== "stable");
       peer.ignoreOffer = !peer.polite && collision;
       if (peer.ignoreOffer) return;