[0.9.1] FORK_IA_UX: review pass — remove dead code + Karvan security hardening

Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
  .hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
  .oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).

Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
  document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
  spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.

src/models/karvan_model.js

@@ -14,6 +14,8 @@ const MAX_ABS_TTL_MS = 24 * 60 * 60 * 1000;      // nunca más de 24 h
 const MAX_MSGS = 250;                            // anillo: solo los últimos N en RAM
 const MAX_SIGNALS = 500;
 const MAX_ROOMS = 100;
+const MAX_MEMBERS = 50;                          // tope de miembros por sala (evita crecimiento sin límite del Set)
+const MAX_SIGNAL_BYTES = 16384;                  // SDP/ICE son pequeños; rechaza payloads gigantes (anti-DoS de memoria)
 
 module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_MS } = {}) => {
   const rooms = new Map(); // id -> room
@@ -120,7 +122,7 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_
     };
     room.messages.push(msg);
     if (room.messages.length > MAX_MSGS) room.messages.shift();
-    room.members.add(msg.from);
+    if (room.members.has(msg.from) || room.members.size < MAX_MEMBERS) room.members.add(msg.from);
     resetIdle(room);
     return msg;
   };
@@ -136,6 +138,10 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_
   const postSignal = (id, { from = "", to = "", payload = null } = {}) => {
     const room = rooms.get(id);
     if (!room) return null;
+    if (payload != null) { // rechaza payloads gigantes (SDP/ICE son pequeños)
+      try { if (JSON.stringify(payload).length > MAX_SIGNAL_BYTES) return null; }
+      catch (e) { return null; }
+    }
     const sig = {
       seq: ++room.sigSeq,
       from: String(from || "").slice(0, 80),
@@ -145,7 +151,7 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_
     };
     room.signals.push(sig);
     if (room.signals.length > MAX_SIGNALS) room.signals.shift();
-    if (sig.from) room.members.add(sig.from);
+    if (sig.from && (room.members.has(sig.from) || room.members.size < MAX_MEMBERS)) room.members.add(sig.from);
     resetIdle(room);
     return sig;
   };