fix: code review — critical and important fixes [v0.2.1]

- inject_message now uses session's event_bus (BOSS_TURN reaches WebSocket/SSE)
- asyncio.get_running_loop() replaces deprecated get_event_loop()
- API keys masked in /api/providers response
- ServerSession (renamed from Session) with cleanup() for handler teardown
- Path traversal protection in _resolve_scenario_path
- XSS fix: escapeHtml(d.name) in web UI
- Duplicate imports removed, os/json moved to module level
- WebSocket handler restructured for reliable cleanup
- New tests: cleanup, provider masking, path traversal

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

meeting_room/static/index.html

@@ -255,12 +255,12 @@
                 const el = document.createElement('div');
                 el.className = 'msg';
                 const color = ROLE_COLORS[d.role_id] || '#999';
-                el.innerHTML = `<div class="name" style="color:${color}">${d.name}</div><div class="content">${escapeHtml(d.content || '')}</div>`;
+                el.innerHTML = `<div class="name" style="color:${color}">${escapeHtml(d.name)}</div><div class="content">${escapeHtml(d.content || '')}</div>`;
                 container.appendChild(el);
             } else if (type === 'agent_error') {
                 const el = document.createElement('div');
                 el.className = 'msg error';
-                el.innerHTML = `<div class="name">${d.name}</div><div class="content">Error: ${escapeHtml(d.error || '')}</div>`;
+                el.innerHTML = `<div class="name">${escapeHtml(d.name)}</div><div class="content">Error: ${escapeHtml(d.error || '')}</div>`;
                 container.appendChild(el);
             } else if (type === 'tool_call') {
                 const el = document.createElement('div');