refactor: extract shared utilities from upstream-fixes

[finedesignz]

Surviving fixes carried from closed PR #1.

What this lands

• Extracts hashToken from hub/src/ws/channel.ts to hub/src/lib/crypto.ts (layering fix; 5 callers updated).
• Dedupes the duplicate loading screen in web/src/App.tsx.

What was dropped (from PR #1)

After verification on current main:

• Shared hubFetch helper migration — main's useProfile.ts has been heavily extended (timezone, cost cap, web push) using raw fetch; refactor is obsolete.
• Profile PATCH response shape change — main already returns the full profile.
• Sessions/plugin sequential-await parallelization — no qualifying handlers.
• Sidebar a11y changes — already proper <button> elements.
• useCallback audit — no observed render thrash.

Test plan

• bun run build in hub/ and web/ (verified locally, both green).
• Manual: agent reconnect (touches hashToken via new import path).

Closes #1 — original upstream-fixes branch was 14 days stale on a -11640 line divergence.