web: clickable links in terminal rows and dashboard messages (issue #233)

docs/web-ui.md

@@ -18,7 +18,11 @@ and the per-agent UIs (manager on :8000, sub-agents on a hashed
   this terminal — sticky-bottom auto-scroll, "↓ N new" pill,
   history backfill, SSE plumbing all live there. Each page
   registers a kind→renderer map; unknown kinds fall through to
-  a JSON-dump note row.
+  a JSON-dump note row. Bare `http(s)://` URLs in row text are
+  turned into clickable new-tab links by `HiveTerminal.linkify`
+  (text-node based, no `innerHTML` — XSS-safe); markdown bodies
+  get the same treatment via `marked`'s autolink, with the
+  rendered `<a>`s rewritten to `target="_blank"` (issue #233).
 - `GET /api/state` → JSON snapshot the JS app renders into the
   DOM. Includes a top-level `seq` (the dashboard event channel's
   high-water mark at the moment the snapshot was assembled);