fix: address code review feedback from coderabbitai

- Add language specifier to fenced code block in expand-project.md
- Remove detailed exception strings from WebSocket responses (security)
- Make WebSocket "start" message idempotent to avoid session reset
- Fix race condition in bulk feature creation with row-level lock
- Add validation for starting_priority (must be >= 1)
- Fix _query_claude to handle multiple feature blocks and deduplicate
- Add FileReader error handling in ExpandProjectChat
- Fix disconnect() to clear pending reconnect timeout
- Enable sandbox mode and validate CLI path in expand_chat_session
- Clean up temporary settings file on session close

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

ui/src/components/ExpandProjectChat.tsx

@@ -121,6 +121,9 @@ export function ExpandProjectChat({
 
         setPendingAttachments((prev) => [...prev, attachment])
       }
+      reader.onerror = () => {
+        setError(`Failed to read file: ${file.name}`)
+      }
       reader.readAsDataURL(file)
     })
   }, [])

ui/src/hooks/useExpandChat.ts

@@ -302,6 +302,10 @@ export function useExpandChat({
       clearInterval(pingIntervalRef.current)
       pingIntervalRef.current = null
     }
+    if (reconnectTimeoutRef.current) {
+      clearTimeout(reconnectTimeoutRef.current)
+      reconnectTimeoutRef.current = null
+    }
     if (wsRef.current) {
       wsRef.current.close()
       wsRef.current = null