Code-quality review: correctness fixes, ErrRequestOverloaded, removeElementsLocked, file split

[linkdata]

Code changes from a quality review of the core jaws package. Documentation-only
improvements are split into a separate stacked PR (code-quality-review-docs,
based on this branch) so this PR stays focused on behavior and structure.

The review found no high/critical issues; these are the low-severity items worth
fixing, each with a test, plus one mechanical refactor.

Fixes (commit 1)

• handleBroadcast string-id framing: reject an HTML-id broadcast target containing
  a tab or newline before it is written verbatim into a wire frame (Jid<0), where it
  would corrupt framing. Satisfies wire.WsMsg.Append's documented no-tab/newline
  precondition; rejects (not escapes) since a valid HTML id has no ASCII whitespace.
• /jaws/.tail/ client binding: bind the one-shot tail drain to the client IP
  with the same loopback-aware equalIP check the WebSocket claim path uses, so a
  leaked key cannot drain (and thereby deny) another client's tail.
• ErrRequestOverloaded: new exported sentinel; the broadcast- and event-channel
  backpressure cancellation causes now wrap it, so callers can classify the teardown
  via context.Cause + errors.Is instead of string-matching.
• removeElementsLocked: extract the byte-for-byte duplicated tagMap-cleanup loop
  shared by handleRemove and deleteElementLocked.
• GenerateHeadHTML: deduplicate extra resources against the built-in CSS path as
  well as the JS path (previously only the JS path was guarded).
• Regression test that errors.Is(err, ErrEventHandlerPanic) stays panic-safe when a
  handler panics with a non-comparable value.

Refactor (commit 2)

• Pure code-motion: move the Jaws-side session helpers + session middleware into
  session.go, and the broadcast/dirt/redirect/alert + SetInner..JsCall helpers into
  a new broadcast.go. jaws.go shrinks 1395 → 936 lines. No behavior change.

Verification

go build, go vet, staticcheck, golangci-lint all clean; go test -race . and
go test -tags debug -race . both pass.

Note: one reviewed finding (a theoretical errors.Is panic via the custom Is
methods) was investigated and not changed — the panic is unreachable through the
public API (unexported sentinel types; the exported sentinels carry nil interface
fields) and the proposed fix would not address the actual stdlib comparison site. A
regression test documents the reachable safe behavior instead.