- Move WebServer class to dedicated file and add module index
- Extract shared types to centralized types.ts
- Fix XSS vulnerability by sanitizing sessionId/tabId in URL parameters
- Fix IPC listener memory leak with proper cleanup on timeout
- Add autoRunStates cleanup when sessions go offline
- Refactor message handlers with send() and sendError() helpers
- Add XSS sanitization tests and e2e test configuration