feat(maestro): force-kill prompt in the web client

The kill button now sends the unforced DELETE immediately instead of
asking first. Only the daemon's guard refusal raises a prompt, and it is
a real dialog rather than confirm(), so it can offer the override the
daemon already implements.

The API error envelope is decoded into ApiRequestError, keeping the code
and the unsaved-work breakdown so the dialog names what is in the way.

web/src/catalog.ts

@@ -1,5 +1,6 @@
 import { escapeHtml } from "./html.js";
-import { getDaemonInfo, killSession, renameSession } from "./api.js";
+import { ApiRequestError, getDaemonInfo, killSession, renameSession } from "./api.js";
+import { openForceKillDialog } from "./killDialog.js";
 import { openContextMenu } from "./contextMenu.js";
 import { isTypingTarget, toggleHelp } from "./help.js";
 import { CatalogStore } from "./events.js";
@@ -180,7 +181,7 @@ function renderNode(node: TreeNode, depth: number): HTMLElement {
   killBtn.addEventListener("click", (ev) => {
     ev.preventDefault();
     ev.stopPropagation();
-    void confirmAndKill(s, name);
+    void requestKill(s, name);
   });
   row.addEventListener("contextmenu", (ev) => {
     ev.preventDefault();
@@ -192,22 +193,31 @@ function renderNode(node: TreeNode, depth: number): HTMLElement {
         onSelect: () =>
           document.dispatchEvent(new CustomEvent(SPAWN_SIMILAR_EVENT, { detail: s })),
       },
-      { label: "Kill session", danger: true, onSelect: () => void confirmAndKill(s, name) },
+      { label: "Kill session", danger: true, onSelect: () => void requestKill(s, name) },
     ]);
   });
   return row;
 }
 
-/** #83: the confirm restates the warning at the moment of decision. */
-async function confirmAndKill(s: Session, name: string): Promise<void> {
-  const blockers = sessionBlockers(s);
-  const question = blockers
-    ? `Kill session "${name}"? Its worktree still has ${formatInTheWay(blockers)} — the kill will be refused unless forced.`
-    : `Kill session "${name}"?`;
-  if (!confirm(question)) return;
+/**
+ * Kill on the first click (#81): the daemon is the one that decides whether a
+ * session may go, and it refuses over a worktree holding unsaved work. Only
+ * that refusal is worth a prompt, and it needs one `confirm()` cannot give —
+ * a forced kill. Anything else surfaces as an alert.
+ */
+async function requestKill(s: Session, name: string): Promise<void> {
   try {
     await killSession(s.id);
   } catch (e) {
+    if (e instanceof ApiRequestError && e.code === "kill_guarded") {
+      openForceKillDialog({
+        name,
+        blockers: e.unsavedWork ?? sessionBlockers(s),
+        reason: e.detail,
+        onForce: () => killSession(s.id, true),
+      });
+      return;
+    }
     alert(`Failed to kill: ${(e as Error).message}`);
   }
 }