feat(mobile-web): align responsive remote control experience

[wgqqqqq]

Summary

• Rebuild the Mobile Web shell around the HarmonyOS mobile information architecture while keeping one shared device/workspace/session behavior across compact and wide layouts.
• Add responsive phone, tablet/narrow-browser, and desktop master-detail layouts, plus aligned pairing, sidebar, settings, workspace, chat header, and composer presentation.
• Preserve account sign-in and restore normal QR pairing with camera scanning, QR image recognition, pasted-link fallback, and validated handoff to the existing encrypted pairing path.
• Improve active-turn composer behavior so Send is replaced by a single desktop-inspired Stop action, with cancellation progress and no duplicate send control.

Fixes #

Type and Areas

Type:

Feature / regression fix / UI/UX / dependency

Areas:

Mobile web, remote control, relay/account pairing UX

Motivation / Impact

Mobile Web had diverged from the HarmonyOS mobile surface in both layout and interaction behavior. Compact and wide browser widths also rendered different session implementations, which made device selection, workspace expansion, session navigation, login, and chat controls inconsistent.

This PR keeps the HarmonyOS page hierarchy and remote-control flow while allowing component-level refinement from the desktop design system. Users can open the same Mobile Web build on a phone, tablet, narrow browser, or desktop browser without changing product logic. Account login and QR pairing are both first-class entry paths.

Verification

• pnpm --dir src/mobile-web run type-check — passed.
• pnpm run build:mobile-web — passed; the QR scanner and worker are emitted as lazy production chunks.
• pnpm run theme:color-audit:all — all selected surfaces passed.
• git diff --check — passed.
• Responsive browser checks at 360, 600, 850, 899/900, and 1280 px — no horizontal overflow; compact-to-wide transition occurs at 900 px.
• Pairing-link validation smoke check — valid Desktop link accepted; missing key, credential-bearing URL, and javascript: URL rejected (4/4).
• Local Mobile Web dev endpoint — HTTP 200 after restart.

Remote scenarios exercised:

• Remote control Mobile Web presentation and local interaction paths were exercised against the local frontend.
• Device/workspace/session behavior now uses the same SessionListPage compact tree in both drawer and persistent master-detail compositions.
• Live relay pairing, cross-version Desktop/mobile negotiation, and a real phone camera permission flow were not re-exercised in this pass; the existing encrypted pairing protocol is reused without wire-shape changes.

Reviewer Notes

• Adds qr-scanner@1.4.2; it is dynamically imported only when the scanner or image recognizer is opened.
• The authenticated shell switches to persistent master-detail at 900 px. Pairing can use its two-column visual composition from 760 px because it does not reserve a navigation rail.
• No backend command or persisted data shape changes are introduced.
• QR values are validated for HTTP(S), pairing route, room/public key shape, relay URL validity, and embedded URL credentials before navigation.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.