feat(mobile): mobile app navigation rework and beta-feedback closeout (#2561)

Navigation model rebuilt around two full-width drawers and a minimal
header (sessions / title-switcher / usage ring / workspace):

- Left sessions drawer: cross-project tree with live status indicators,
  swipe actions on sessions (rename/archive/delete) and on group headers
  (project edit / two-step close, worktree delete), reorder-only edit
  mode with collapsible project cards and draggable worktrees, app-level
  footer (connected instance, settings, pending web update).
- Right workspace drawer: Changes / Files / Terminal / Notes / MCP as
  pill tabs (inactive tabs icon-only); panes stay mounted once visited.
  The full desktop file editor serves the Files tab; read/skill tool taps
  in chat open the file there at the requested line.
- Header session switcher on title tap: 10 cross-project recents with
  live busy/attention indicators and project · branch metadata; the
  usage ring opens a metadata overlay with an explicit loading state.
- The overflow menu is gone on phones (its destinations moved into the
  drawers); iPad keeps it until its dedicated layout pass.

Correctness and continuity:

- /auth/session answers bearer-first, so a stale WebView cookie can no
  longer mask a revoked device token; cold launches classify failures
  fast and land on an explicit connect screen.
- Authoritative session snapshots raise frozen ordering baselines and
  stale live ranks — recents stay truthful after the app slept.
- Cold launches reopen the last active session per instance (persisted
  pointer, confirmed against a sessions snapshot; a user-opened draft
  clears it), with a logo hold instead of a draft flash.

Also: collapsed pill composer gains the stop control; chat tool rows
share one 36px rhythm; Task subtool rows truncate; larger bottom safe
area so the composer clears big-screen corner radii; Capacitor build
hides About/Update (store updates apply there); widgets link to the
sessions drawer with a list icon; MobileApp split into focused modules;
five mobile-surface detectors unified; translucent borders normalized to
70%; all new strings translated across the 10 locales.

iPad and foldable layouts are intentionally untouched - separate next version PR.

packages/web/server/lib/ui-auth/ui-auth.js

@@ -749,6 +749,21 @@ export const createUiAuth = ({
   };
 
   const handleSessionStatus = async (req, res) => {
+    // An explicit bearer credential decides the answer on its own. Native
+    // clients probe with the token their runtime transport will actually use;
+    // falling back to the ambient session cookie here masked revoked tokens
+    // (cookie said "authenticated", every bearer-only API call then 401'd).
+    const authorization = req.headers?.authorization;
+    const hasBearer = typeof authorization === 'string' && authorization.toLowerCase().startsWith('bearer ');
+    if (hasBearer) {
+      const clientAuth = await authenticateClientRequest(req, { allowUrlToken: false });
+      if (clientAuth) {
+        res.json({ authenticated: true, scope: 'client' });
+        return;
+      }
+      res.status(401).json({ authenticated: false, locked: true });
+      return;
+    }
     const token = getTokenFromRequest(req);
     if (await isSessionValid(token)) {
       res.json({ authenticated: true });

packages/web/src/main.tsx

@@ -2,8 +2,7 @@ import { createConfiguredWebAPIs, getDesktopRelayRestoreReady } from './runtimeC
 import { registerSW } from 'virtual:pwa-register';
 
 import type { RuntimeAPIs } from '@openchamber/ui/lib/api/types';
-import { getStoredMobileLayoutPreference } from '@openchamber/ui/lib/mobileLayoutPreference';
-import type { HostedSurface } from '@openchamber/ui/lib/runtimeSurface';
+import { resolveHostedSurface, type HostedSurface } from '@openchamber/ui/lib/runtimeSurface';
 import {
   isEmbeddedSessionChat,
   requestEmbeddedSessionRuntimeBootstrap,
@@ -18,28 +17,7 @@ declare global {
   }
 }
 
-const isCoarsePointer = (): boolean => {
-  if (typeof window === 'undefined' || typeof window.matchMedia !== 'function') {
-    return false;
-  }
-
-  return window.matchMedia('(pointer: coarse)').matches;
-};
-
-const detectHostedSurface = (): HostedSurface => {
-  const params = new URLSearchParams(window.location.search);
-  const override = params.get('surface');
-  if (override === 'mobile') return 'mobile';
-  if (override === 'desktop') return 'desktop';
-
-  const width = Math.min(window.innerWidth || 0, window.screen?.width || window.innerWidth || 0);
-  const touchPoints = navigator.maxTouchPoints || 0;
-  const likelyPhone = width > 0 && width <= 760 && (touchPoints > 0 || isCoarsePointer());
-  return likelyPhone && getStoredMobileLayoutPreference() === 'new' ? 'mobile' : 'desktop';
-};
-
-const hostedSurface = detectHostedSurface();
-window.__OPENCHAMBER_SURFACE__ = hostedSurface;
+const hostedSurface: HostedSurface = resolveHostedSurface();
 
 type PrerenderingDocument = Document & {
   prerendering?: boolean;