fix: address code review findings from Phase 2 final review

- ChatPanel: add 'chat-message ${role}' CSS classes to message wrappers
  so .chat-message.user and .chat-message.assistant rules apply correctly
- LoginPage: rename className 'login-error' -> 'error' to match the
  .login-card .error selector in globals.css
- MCPAppRenderer: verify event.source matches iframe contentWindow before
  processing postMessage to close cross-window injection vector
- App: remove redundant await refresh() after createNew() since
  createNew() already calls refresh() internally
- useArtifacts: wrap listArtifacts call in try/catch with console.error,
  matching the error-handling pattern already used in useSessions

frontend/src/App.tsx

@@ -31,7 +31,6 @@ function App() {
         onSelect={(id) => switchTo(id)}
         onCreate={async () => {
           await createNew()
-          await refresh()
         }}
         onLogout={logout}
       />

frontend/src/components/ChatPanel.tsx

@@ -58,7 +58,7 @@ export function ChatPanel({ messages, isStreaming, onSend, sessionId }: ChatPane
     <div className='chat-panel'>
       <div className='chat-messages'>
         {messages.map(message => (
-          <div key={message.id}>
+          <div key={message.id} className={`chat-message ${message.role}`}>
             {message.role === 'assistant' ? (
               <div>
                 <ReactMarkdown>{message.content}</ReactMarkdown>

frontend/src/components/LoginPage.tsx

@@ -28,7 +28,7 @@ export function LoginPage({ onLogin }: LoginPageProps) {
     <div className="login-page">
       <form className="login-card" onSubmit={handleSubmit}>
         <h2>Research Workbench</h2>
-        {error && <div className="login-error">{error}</div>}
+        {error && <div className="error">{error}</div>}
         <label htmlFor="email">Email</label>
         <input
           id="email"

frontend/src/components/MCPAppRenderer.tsx

@@ -53,6 +53,7 @@ export function MCPAppRenderer({
   const handleMessage = useCallback(
     (event: MessageEvent) => {
       if (!iframeRef.current?.contentWindow) return
+      if (event.source !== iframeRef.current.contentWindow) return
 
       const msg = event.data
       if (!msg || msg.jsonrpc !== '2.0') return

frontend/src/hooks/useArtifacts.ts

@@ -8,8 +8,12 @@ export function useArtifacts(sessionId: string | null) {
 
   async function refresh() {
     if (!sessionId) return
-    const data = await api.listArtifacts(sessionId)
-    setArtifacts(data)
+    try {
+      const data = await api.listArtifacts(sessionId)
+      setArtifacts(data)
+    } catch (err) {
+      console.error('Failed to list artifacts:', err)
+    }
   }
 
   async function loadArtifact(name: string) {