fix(input): prevent navigation keys from leaking into editable text

[bobleer]

Summary

Prevent navigation/function-key payloads from becoming invisible text in FlowChat and other form fields. Install a shared native input guard in the desktop/web UI, mobile web, and installer; retain normal navigation, IME composition, selections, and meaningful Unicode such as joined emoji.

Type and Areas

Type: Bug fix.

Areas: Shared browser input handling, FlowChat, mobile web, installer.

Motivation / Impact

FlowChat omitted AppKit function-key characters from its sanitizer and relied on inputType from React 18's synthesized onBeforeInput, which does not reliably expose the native event. Ordinary fields had no equivalent protection.

The native capture guard cancels pure control-character insertions before editing and repairs mixed or non-cancellable input before field handlers consume it. FlowChat also sanitizes pasted content before handing it to the large-paste owner, preserves Unicode joiners, and no longer treats key-control payloads as printable keys for autofocus. Model-owned editor and terminal buffers remain exempt from DOM repair.

Verification

• 70 focused tests passed: pnpm --dir src/web-ui exec vitest run --maxWorkers=50% src/shared/utils/textInputGuard.test.tsx src/flow_chat/components/RichTextInput.test.tsx src/flow_chat/hooks/useComposerDefaultFocus.test.tsx src/flow_chat/utils/chatInputKeyOwnership.test.ts
• Passed: pnpm --dir src/web-ui exec tsc --noEmit, pnpm --dir src/mobile-web run type-check, pnpm --dir OpenBitFun-Installer run type-check.
• Passed: changed production-file ESLint, pnpm run appearance:contract-audit, pnpm run theme:color-audit:test, pnpm run theme:color-audit:all, pnpm run theme:visual-contract, and git diff --check.
• pnpm run check:web is blocked by 25 pre-existing typography audit violations in unchanged Design Lab/mobile component styles. Its remaining relevant checks were run separately as listed above.

Reviewer Notes

AI-assisted implementation; automated DOM and type coverage completed. Native OS keyboard reproduction and remote-workspace, remote-control, Peer Device, and Detached Dispatch integration were not exercised. This changes frontend input handling only; persisted shapes and transport protocols are unchanged. No visual layout changes.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.