chore(audit): tool path resolution, config file, dead code removal, static analysis cleanup

Tool fixes:
- FileWriteTool, FileEditTool: resolve relative paths against workingDir instead of JVM cwd
- FileReadTool: remove allowedPaths restriction — reads are unrestricted
- ShellTool: add workingDir for ProcessBuilder, remove environment().clear(), fail-open when allowedExecutables empty

Config:
- Add [tools] section to config.toml: sandbox_root, working_dir, shell_allowed_executables, default_system_prompt_path
- Three-level resolution: env var > config file > hardcoded default
- OrchestrationConfig sandboxRoot and defaultSystemPromptPath now sourced from CorrexConfig
- Single defaultOrchestrationConfig in ServerModule, shared by SessionRoutes and GlobalStreamHandler

Dead code:
- Delete EventTypes.kt — orphaned string constants duplicating serialization annotations

Static analysis:
- Remove 10 unused imports across 9 files
- Remove redundant return in ReplayOrchestrator
- Remove redundant suspend from ApprovalCoordinator.handleResponse
- Fix unreachable InputMode.None branch in InputBar
- Enable full detekt rule sets in detekt.yml

build.gradle

@@ -8,6 +8,7 @@ plugins {
     id 'org.jetbrains.kotlin.plugin.compose' version '2.2.10' apply false
     id "io.gitlab.arturbosch.detekt" version "1.23.7"
     id "org.jetbrains.kotlinx.kover" version "0.8.3"
+    id "org.sonarqube" version "5.1.0.4882"
 }
 
 ext {
@@ -49,11 +50,11 @@ subprojects {
 
         kover {
             reports {
-//                verify {
-//                    rule {
-//                        minBound(80)
-//                    }
-//                }
+                verify {
+                    rule {
+                        minBound(70)
+                    }
+                }
                 filters {
                     excludes {
                         classes("*Generated*")