feat(window): confirm multi-line pastes

[roramirez]

Summary

Adds window.paste_confirm_lines (default 0 = disabled) to guard against accidentally executing pasted multi-line content. When set to N > 0, pasting clipboard text whose newline count is >= N shows a modal confirmation overlay ([y] Paste, [n]/Esc Cancel) instead of writing to the PTY. With the default 0, behavior is unchanged.

Changes

• Config: new window.paste_confirm_lines: usize (serde default 0) in WindowConfig, plus assets/config.toml and the in-app config TUI (new F_PASTE_CONFIRM field, build_config read).
• State: AppState.pending_paste: Option<String> holds the raw clipboard text awaiting confirmation.
• Interception: both paste paths (do_paste and do_middle_click_paste) now delegate to a shared App::paste_text, which gates multi-line pastes; the raw text is re-encoded on confirm so the pane's bracketed-paste state is read at send time (middle-click keeps its always-bracketed semantics on immediate send).
• Overlay: try_dispatch_overlay_key handles the confirm/cancel keys (checked before mode dispatch); draw_paste_confirm renders the dialog over the dimmed buffer.
• Docs: doc/SPEC.md config table + prose, README.md [window] block, CHANGELOG.md.
• Tests: paste gating (threshold met / disabled / below-threshold / cleared-on-take), overlay draw no-panic + dims, config default + round-trip, and updated field-count/section asserts.

How to test

• cargo test — 1217 tests pass (8 new).
• cargo clippy --locked -- -D warnings — clean.
• Manual: set paste_confirm_lines = 2 in config.toml, copy a 3-line block, paste (Ctrl+Shift+V or middle-click). The confirmation overlay appears; y pastes, n/Esc cancels. With paste_confirm_lines = 0, pastes go through unchanged.