[0.9.1] FORK_IA_UX: review pass — remove dead code + Karvan security hardening

Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
  .hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
  .oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).

Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
  document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
  spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.

src/views/karvan_view.js

@@ -17,7 +17,6 @@ const shortId = (id) => {
   id = String(id || "?");
   return id.startsWith("@") ? id.slice(1, 7) : id.slice(0, 6);
 };
-exports.karvanShortId = shortId;
 
 const renderMsg = (m) =>
   li({ class: "karvan-msg", "data-seq": String(m.seq), "data-mid": m.mid || "" },
@@ -31,7 +30,7 @@ const ttlOpt = (val, lbl, checked) =>
     span(lbl)
   );
 
-exports.karvanView = (rooms, params = {}) =>
+exports.karvanView = (rooms) =>
   template(
     i18n.karvanTitle || "Karvan",
     section({ class: "karvan-intro" },

src/views/main_views.js

@@ -1272,33 +1272,6 @@ const renderHiveNav = () => {
 };
 exports.renderHiveNav = renderHiveNav;
 
-// FORK_IA_UX: el hive vive en una HOJA INFERIOR (bottom-sheet) alcanzable con el pulgar; sin JS (checkbox-hack).
-// Un checkbox oculto (#fork-explore-toggle) y la hoja son hermanos dentro de .fork-sheet-wrap (display:contents),
-// así `#fork-explore-toggle:checked ~ .hive-sheet` la despliega; el botón "Explore" de la barra es su <label>.
-const renderHiveSheet = () => {
-  if (process.env.OASIS_MOBILE !== '1') return "";
-  const q = (href, ico, lbl) => a({ class: "hsq-item", href },
-    span({ class: "hsq-ico" }, ico), span({ class: "hsq-lbl" }, lbl));
-  return div({ class: "fork-sheet-wrap" },
-    input({ type: "checkbox", id: "fork-explore-toggle", class: "fork-sheet-toggle" }),
-    div({ class: "hive-sheet" },
-      label({ class: "hive-sheet-backdrop", for: "fork-explore-toggle", "aria-label": "Close" }),
-      div({ class: "hive-sheet-panel" },
-        label({ class: "hive-sheet-grip", for: "fork-explore-toggle", "aria-label": "Close" }),
-        // accesos que no están en el hive (CATS): red y estado
-        div({ class: "hive-sheet-quick" },
-          q("/peers",    "⧖", "Peers"),
-          q("/graphos",  "◈", "Graphos"),
-          q("/inbox",    "☂", "Inbox"),
-          q("/settings", "⚙", "Settings")
-        ),
-        renderHiveNav()
-      )
-    )
-  );
-};
-exports.renderHiveSheet = renderHiveSheet;
-
 const template = (titlePrefix, ...elements) => {
   const currentConfig = getConfig();
   const theme = currentConfig.themes.current || "Dark-SNH";