feat(diagnostic): ARIA-Live (read-only Terminal-Mirror) + Not-Aus statt SSH-Tab

SSH-Tab raus — funktionierte eh nicht zuverlaessig und war konzeptionell
falsch. Stattdessen Live-Mirror der Claude-Code-Session:

- proxy-patches/routes.js: assistant + user Events parsed → POSTed Tool-
  Inputs (truncated 2 KB) + Tool-Results (truncated 4 KB) + Assistant-Text
  an aria-bridge:8090/internal/agent-stream. start/end Marker pro Session.
  Subprocess-Tracking (_activeSubprocesses Map) + interner Side-Channel
  auf Port 3457 mit POST /cancel-all fuer Hard-Kill.

- bridge: neuer /internal/agent-stream Endpoint pusht 1:1 als RVS
  agent_stream. cancel_request Handler nimmt optional 'hard'-Flag —
  triggert dann zusaetzlich _cancel_proxy_subprocesses() das den Proxy-
  Side-Channel ruft.

- rvs: agent_stream whitelisted.

- diagnostic: SSH-Tab → 'ARIA Live'. Monospace-Stream, farbcodiert
  (text=hell, tool_use=cyan, tool_result=gruen/rot, thinking=gelb-italic),
  Auto-Scroll, max 2000 Zeilen Backlog. Roter ⛔ Not-Aus-Button mit
  Confirm → aria_panic_stop action → diagnostic-server broadcastet
  cancel_request mit hard:true.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

diagnostic/server.js

@@ -633,6 +633,11 @@ function connectRVS(forcePlain) {
             tool: msg.payload?.tool || msg.tool || "",
           });
         }
+      } else if (msg.type === "agent_stream") {
+        // Voller Live-Stream der Claude-Code-Session (assistant_text +
+        // tool_use mit Input + tool_result mit truncated Output). Geht
+        // 1:1 an Browser durch — die ARIA-Live-View rendert's.
+        broadcast({ type: "agent_stream", payload: msg.payload });
       } else if (msg.type === "memory_saved") {
         // ARIA hat selber etwas in die Qdrant-DB gespeichert (via memory_save Tool).
         const m = msg.payload || {};
@@ -1887,6 +1892,18 @@ wss.on("connection", (ws) => {
         if (traceActive) traceEnd(false, "Vom Benutzer abgebrochen");
         broadcast({ type: "agent_activity", activity: "idle" });
         dockerExec("aria-core", "openclaw doctor --fix 2>/dev/null || true").catch(() => {});
+      } else if (msg.action === "aria_panic_stop") {
+        // NOT-AUS aus ARIA-Live-View: lokales /api/cancel UND Hard-Kill via
+        // Bridge (die wiederum den Proxy-Side-Channel /cancel-all anruft).
+        log("warn", "server", "⛔ NOT-AUS — hard cancel + proxy /cancel-all");
+        pendingMessageTime = 0;
+        watchdogWarned = false;
+        watchdogFixAttempted = false;
+        if (traceActive) traceEnd(false, "Vom Benutzer per NOT-AUS abgebrochen");
+        broadcast({ type: "agent_activity", activity: "idle" });
+        // RVS-Broadcast cancel_request mit hard:true → aria-bridge ruft
+        // den Proxy-/cancel-all Side-Channel an, killt alle Subprocesses.
+        sendToRVS_raw({ type: "cancel_request", payload: { hard: true, source: "diagnostic-panic" }, timestamp: Date.now() });
       } else if (msg.action === "voice_upload") {
         // Voice-Samples an XTTS-Bridge via RVS weiterleiten, auf Bestätigung warten
         log("info", "server", `Voice-Upload '${msg.name}' (${(msg.samples || []).length} Samples) sende an RVS...`);