fix: address code review findings from Phase 2 final review

- ChatPanel: add 'chat-message ${role}' CSS classes to message wrappers
  so .chat-message.user and .chat-message.assistant rules apply correctly
- LoginPage: rename className 'login-error' -> 'error' to match the
  .login-card .error selector in globals.css
- MCPAppRenderer: verify event.source matches iframe contentWindow before
  processing postMessage to close cross-window injection vector
- App: remove redundant await refresh() after createNew() since
  createNew() already calls refresh() internally
- useArtifacts: wrap listArtifacts call in try/catch with console.error,
  matching the error-handling pattern already used in useSessions

frontend/src/components/LoginPage.tsx

@@ -28,7 +28,7 @@ export function LoginPage({ onLogin }: LoginPageProps) {
     <div className="login-page">
       <form className="login-card" onSubmit={handleSubmit}>
         <h2>Research Workbench</h2>
-        {error && <div className="login-error">{error}</div>}
+        {error && <div className="error">{error}</div>}
         <label htmlFor="email">Email</label>
         <input
           id="email"