fix: address code review findings from Phase 2 final review

- ChatPanel: add 'chat-message ${role}' CSS classes to message wrappers
  so .chat-message.user and .chat-message.assistant rules apply correctly
- LoginPage: rename className 'login-error' -> 'error' to match the
  .login-card .error selector in globals.css
- MCPAppRenderer: verify event.source matches iframe contentWindow before
  processing postMessage to close cross-window injection vector
- App: remove redundant await refresh() after createNew() since
  createNew() already calls refresh() internally
- useArtifacts: wrap listArtifacts call in try/catch with console.error,
  matching the error-handling pattern already used in useSessions

frontend/src/components/ChatPanel.tsx

@@ -58,7 +58,7 @@ export function ChatPanel({ messages, isStreaming, onSend, sessionId }: ChatPane
     <div className='chat-panel'>
       <div className='chat-messages'>
         {messages.map(message => (
-          <div key={message.id}>
+          <div key={message.id} className={`chat-message ${message.role}`}>
             {message.role === 'assistant' ? (
               <div>
                 <ReactMarkdown>{message.content}</ReactMarkdown>