fix(web): close P3 chat re-review findings

apps/web/src/spa/chat/session-panel.tsx

@@ -1,5 +1,6 @@
 import type { ReactElement } from 'react';
 import type { SessionInfoPayload } from '@/lib/chat-contract';
+import { MAX_MANIFEST_ITEMS } from './limits';
 import { asString, asStringArray } from './runtime-guards';
 
 interface SessionPanelProps {
@@ -15,7 +16,13 @@ export function SessionPanel({
 }: SessionPanelProps): ReactElement | null {
   if (!sessionInfo) return null;
 
-  const availableThinkingLevels = asStringArray(sessionInfo.availableThinkingLevels);
+  // The reducer already caps this before storing it, but the render site
+  // defends independently — a hostile payload must never be able to force
+  // this <select> to lay out an unbounded number of options.
+  const availableThinkingLevels = asStringArray(sessionInfo.availableThinkingLevels).slice(
+    0,
+    MAX_MANIFEST_ITEMS,
+  );
   const hasThinkingLevels = availableThinkingLevels.length > 0;
 
   return (