test(web): transcripts API + attacker-transcripts router coverage

Paging, truncation surfacing, admin gate, path traversal, sid-regex and
decky-mismatch rejection for /transcripts; mirror coverage for
/attackers/{uuid}/transcripts. Flips the Session Recording box in the
roadmap (sessrec pty relay now shipping end-to-end).

decnet/web/router/transcripts/api_get_transcript.py

@@ -58,7 +58,7 @@ def _get_index(path: Path) -> tuple[dict[str, list[tuple[int, int]]], int]:
             # Fast sid extract: look for `"sid":"<36 chars>"` prefix — every
             # sessrec line starts with that field (see emit_*).
             try:
-                m = re.search(rb'"sid":"([a-f0-9-]{36})"', line)
+                m = re.search(rb'"sid"\s*:\s*"([a-f0-9-]{36})"', line)
             except re.error:
                 m = None
             if m: