feat: Rich hook forwarding, permission bridge, and toast notifications

Replace hardcoded PowerShell status hooks with stdin-forwarding hooks
that send full Claude Code hook data (tool_input, tool_response, prompt,
session_id, model, etc.) to /api/claude-hook endpoint.

- PowerShell hooks read stdin JSON and POST to /api/claude-hook
- Server derives status for backward-compat FAB animations
- Server extracts assistant_response from transcript on Stop events
- New /api/claude-permission endpoint with Promise-based allow/deny flow
- HookNotifications.vue: toast system showing session, prompt, tool use,
  tool results, notifications, and final assistant response
- WebSocket broadcast for claude-hook and claude-permission message types

server/services/terminal.ts

@@ -124,6 +124,28 @@ export function startTerminalServer() {
         }
       }
 
+      // Claude hook broadcast endpoint (rich data from stdin)
+      if (url.pathname === '/claude-hook' && req.method === 'POST') {
+        try {
+          const body = await req.json()
+          broadcastClaudeHook(body)
+          return Response.json({ success: true }, { headers: corsHeaders })
+        } catch {
+          return Response.json({ error: 'Invalid JSON' }, { status: 400, headers: corsHeaders })
+        }
+      }
+
+      // Claude permission request broadcast endpoint
+      if (url.pathname === '/claude-permission' && req.method === 'POST') {
+        try {
+          const body = await req.json()
+          broadcastPermissionRequest(body)
+          return Response.json({ success: true }, { headers: corsHeaders })
+        } catch {
+          return Response.json({ error: 'Invalid JSON' }, { status: 400, headers: corsHeaders })
+        }
+      }
+
       // Check if this is a WebSocket upgrade request
       const upgradeHeader = req.headers.get('upgrade')
       console.log(`[Terminal] Request: ${req.method} ${url.pathname}, Upgrade: ${upgradeHeader}`)
@@ -269,3 +291,49 @@ export function broadcastClaudeStatus(status: ClaudeStatus, tool?: string, agent
 
   console.log(`[Terminal] Claude status broadcast: ${status}${tool ? ` (${tool})` : ''} → ${clientCount} clients`)
 }
+
+// Broadcast full Claude hook data to ALL clients
+export function broadcastClaudeHook(data: Record<string, unknown>) {
+  const message = JSON.stringify({
+    type: 'claude-hook',
+    ...data,
+    timestamp: Date.now()
+  })
+
+  let clientCount = 0
+  for (const [, session] of sessions) {
+    for (const ws of session.clients) {
+      try {
+        ws.send(message)
+        clientCount++
+      } catch {
+        // Client disconnected, ignore
+      }
+    }
+  }
+
+  console.log(`[Terminal] Claude hook broadcast: ${data.hook_event_name || 'unknown'}${data.tool_name ? ` (${data.tool_name})` : ''} → ${clientCount} clients`)
+}
+
+// Broadcast permission request to ALL clients
+export function broadcastPermissionRequest(data: Record<string, unknown>) {
+  const message = JSON.stringify({
+    type: 'claude-permission',
+    ...data,
+    timestamp: Date.now()
+  })
+
+  let clientCount = 0
+  for (const [, session] of sessions) {
+    for (const ws of session.clients) {
+      try {
+        ws.send(message)
+        clientCount++
+      } catch {
+        // Client disconnected, ignore
+      }
+    }
+  }
+
+  console.log(`[Terminal] Permission request broadcast: ${data.tool_name || 'unknown'} (${data.requestId}) → ${clientCount} clients`)
+}