fix: remove rel=noopener from all session/instance links to enable tab reuse

rel=noopener forces a fresh browsing context, breaking target name matching
and window reference tracking across browsers.

Changes:
- use-instance-actions.ts: track opened tabs in Map, call .focus() on existing
- session-card.tsx: all Open buttons now go through handleOpen callback
- app-shell.tsx: sidebar session links use target='session-{id}' + noreferrer
- workspace-instance-chips.tsx: remove noopener from chip links
- instance-list.tsx: remove noopener from Open links
- WorkspaceDetailPage.tsx: use named target + noreferrer

Quality gates: tsc --noEmit pass, npm run build pass, 80/80 tests pass

apps/web/src/components/features/tool/instance-list.tsx

@@ -286,7 +286,7 @@ export const InstanceList = ({
 														: `${API_BASE_URL}${instance.url}`
 												}
 												target={`instance-${instance.id}`}
-												rel="noopener noreferrer"
+												rel="noreferrer"
 												className="secondary-button small"
 											>
 												<Icon name="external" size="sm" />