[0.9.1] FORK_IA_UX: review pass — remove dead code + Karvan security hardening

Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
  .hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
  .oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).

Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
  document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
  spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.

src/views/karvan_view.js

@@ -17,7 +17,6 @@ const shortId = (id) => {
   id = String(id || "?");
   return id.startsWith("@") ? id.slice(1, 7) : id.slice(0, 6);
 };
-exports.karvanShortId = shortId;
 
 const renderMsg = (m) =>
   li({ class: "karvan-msg", "data-seq": String(m.seq), "data-mid": m.mid || "" },
@@ -31,7 +30,7 @@ const ttlOpt = (val, lbl, checked) =>
     span(lbl)
   );
 
-exports.karvanView = (rooms, params = {}) =>
+exports.karvanView = (rooms) =>
   template(
     i18n.karvanTitle || "Karvan",
     section({ class: "karvan-intro" },