feat(terminal): refactor runtime and add mobile workspace (#2280)

Replace the legacy terminal flow with a shared authenticated WebSocket
runtime used across web, desktop, relay, and mobile surfaces.

- introduce the v3 terminal protocol with scoped attachments, snapshots,
  ordered output, bounded replay history, reconnects, and explicit lifecycle
- harden PTY creation, restart, resize, close, force-kill, idle cleanup,
  shell selection, login mode, environment sanitization, and appearance sync
- add runtime-aware terminal APIs with relay authentication and Electron parity
- add a fullscreen mobile terminal workspace with touch scrolling,
  long-press selection, safe-area controls, quick keys, and Ctrl/Alt input
- add terminal selection attachments, preview detection, project actions,
  shell settings, and localized UI
- harden Ghostty rendering, resize recovery, Unicode handling, block
  characters, line height, and stale-row behavior
- remove the obsolete terminal SSE path and update reverse-proxy guidance
- expand terminal runtime, transport, input, selection, and store coverage
- avoid duplicate web builds when preparing mobile assets in root CI builds

packages/web/server/lib/relay/host-client.test.js

@@ -111,8 +111,19 @@ const startLoopbackOrigin = () =>
   new Promise((resolve) => {
     const server = http.createServer((req, res) => {
       if (req.url === '/health') {
+        const expectedOrigin = `http://127.0.0.1:${server.address().port}`;
+        if (req.headers.origin !== expectedOrigin) {
+          res.writeHead(403, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Invalid origin' }));
+          return;
+        }
         res.writeHead(200, { 'content-type': 'application/json' });
-        res.end(JSON.stringify({ ok: true, service: 'stub', relayConn: req.headers['x-openchamber-relay-connection'] || null }));
+        res.end(JSON.stringify({
+          ok: true,
+          service: 'stub',
+          relayConn: req.headers['x-openchamber-relay-connection'] || null,
+          origin: req.headers.origin,
+        }));
         return;
       }
       res.writeHead(404);
@@ -269,6 +280,7 @@ describe('relay host-client integration', () => {
     expect(result.status).toBe(200);
     expect(result.body.ok).toBe(true);
     expect(result.body.relayConn).toBe('conn-test-1');
+    expect(result.body.origin).toBe(`http://127.0.0.1:${origin.port}`);
 
     // Every forwarded frame after the two plaintext handshake frames (client
     // hello, host ready) must be binary.