fix: broadcast submitted prompts to every web client and drop --allow-remote-terminals

The engine now publishes prompt.submitted when a prompt is enqueued and
prompt.started when its turn launches; the gateway projects both into the
transcript so a message sent from one web client shows up on every other
client attached to the same session.

PTY terminal routes stay available on loopback binds only; the
--allow-remote-terminals flag is removed from 'pythinker web'.

Author: elkaix

apps/pythinker-code/test/cli/web/web.test.ts

@@ -409,7 +409,6 @@ describe('`pythinker web` option threading', () => {
         dangerousBypassAuth: true,
         debugEndpoints: true,
         allowRemoteShutdown: true,
-        allowRemoteTerminals: true,
         open: false,
       },
       { startServerForeground: runner, openUrl: vi.fn(), stdout, stderr },
@@ -422,7 +421,6 @@ describe('`pythinker web` option threading', () => {
       debugEndpoints: true,
       insecureNoTls: true,
       allowRemoteShutdown: true,
-      allowRemoteTerminals: true,
       dangerousBypassAuth: true,
       allowedHosts: ['.example.com'],
     });