fix: resolve HMR, hydration, Windows dev, and supply chain issues

[outsourc-e]

Summary

Fixes 5 open issues in ClawSuite:

#54 — vite.config.ts: allowedHosts default breaks local dev HMR

Gate HMR/host overrides on CLAWSUITE_ALLOWED_HOSTS env var being explicitly set (via exposedOverNetwork boolean), not on the derived array length. The ['.ts.net'] fallback made allowedHosts.length > 0 always true, forcing wss://:443 HMR on local dev.

#52 — Can't npm run dev on Windows without removing NODE_OPTIONS

Added cross-env as a devDependency and wrapped all NODE_OPTIONS env var assignments in package.json scripts. Windows cmd doesn't support Unix-style VAR=value command syntax.

#53 — White screen on fresh install (setState undefined in AwaitInner)

Fixed useSyncExternalStore calls in session-title-store.ts and use-dashboard-settings.ts that used the same getSnapshot for both client and server. The server snapshot was calling localStorage (undefined on server), causing hydration mismatches. Added proper getServerSnapshot functions that return stable defaults.

#50 — Terminal xterm onData not wired after hydration mismatch

Same root cause as #53 — hydration mismatches from useSyncExternalStore. The terminal route already has ssr: false and lazy loading, so this was likely resolved by the broader hydration fixes.

#51 — TanStack Router supply chain vulnerability (GHSA-g7cv-rxg3-hmpx)

Updated @tanstack/react-start to 1.168.10 (above patched 1.167.72) and @tanstack/react-router to ^1.170.0 (above patched 1.169.9). Both are now above the patched versions for the malware-affected packages.

Changes

• vite.config.ts: Added exposedOverNetwork boolean, used for HMR/host gating
• package.json: cross-env for NODE_OPTIONS, updated TanStack deps
• src/screens/chat/session-title-store.ts: proper SSR server snapshot
• src/screens/dashboard/hooks/use-dashboard-settings.ts: proper SSR server snapshot

Closes #50, #51, #52, #53, #54