refactor(phase5): Comprehensive stabilisation pass. De-duplicated App/Controller state, hardened session reset, and updated integration tests with deterministic polling.

src/api_hooks.py

@@ -296,13 +296,14 @@ class HookHandler(BaseHTTPRequestHandler):
    self.wfile.write(json.dumps({"error": str(e)}).encode("utf-8"))
 
  def do_POST(self) -> None:
-  app = self.server.app
-  content_length = int(self.headers.get("Content-Length", 0))
-  body = self.rfile.read(content_length)
-  body_str = body.decode("utf-8") if body else ""
-  session_logger.log_api_hook("POST", self.path, body_str)
   try:
+   app = self.server.app
+   content_length = int(self.headers.get("Content-Length", 0))
+   body = self.rfile.read(content_length)
+   body_str = body.decode("utf-8") if body else ""
+   session_logger.log_api_hook("POST", self.path, body_str)
    data = json.loads(body_str) if body_str else {}
+   print(f'[HOOKS] POST {self.path} data length: {len(data)}')
    if self.path == "/api/project":
     project = _get_app_attr(app, "project")
     _set_app_attr(app, "project", data.get("project", project))
@@ -654,6 +655,8 @@ class HookHandler(BaseHTTPRequestHandler):
     self.send_response(404)
     self.end_headers()
   except Exception as e:
+   import traceback
+   traceback.print_exc(file=sys.stderr)
    self.send_response(500)
    self.send_header("Content-Type", "application/json")
    self.end_headers()