feat(kiosk): companion remote drives app iframes via trusted CDP input

Companion tap/scroll/type now works INSIDE cross-origin app iframes and
kiosk tabs. The web relay synthesizes untrusted DOM events in the top
document, which can never cross an origin boundary — so apps served
through the appgate were dead to the remote. The kiosk Chromium now
exposes a loopback-only CDP port (default origin check intact, no
--remote-allow-origins) and a backend bridge (api/handler/cdp.rs)
dispatches validated companion input as Input.dispatchKeyEvent /
dispatchMouseEvent / mouseWheel — trusted events that hit-test through
any frame, move real focus, and insert text like a physical device.

- Session keeper self-heals across kiosk Chromium restarts; inert on
  nodes without a kiosk unit (falls back to the existing relay path).
- The kiosk relay subscriber self-tags (?kiosk=1) and the backend mutes
  its key/click/scroll messages while the bridge is live, so input never
  applies twice; cursor moves still flow for the on-screen cursor.
- While companion input is active the native OS pointer is hidden
  (cursor:none, auto-restores 30s after the last event) so the dead
  physical-mouse cursor doesn't sit next to the virtual one.
- docs/tv-input-iframe-apps.md scope note updated: gamepad keys stay on
  uinput; CDP is for companion pointer/typing only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/src/style.css

@@ -1730,6 +1730,15 @@ html.kiosk-mode::before {
   will-change: auto !important;
 }
 
+/* While the companion app is actively driving input, hide the native OS
+   pointer — it sits dead wherever the physical mouse left it and reads as
+   a second cursor next to the companion's virtual one. remote-relay.ts
+   toggles this class and clears it 30s after the last companion event. */
+html.companion-input-active,
+html.companion-input-active * {
+  cursor: none !important;
+}
+
 /* Dashboard: full viewport width, no letterboxing, no body scroll */
 body.dashboard-active {
   overflow: hidden;