feat(app): close upstream lifecycle, metadata, and content composition gaps

[jinzhongjia]

Closes several open semantic gaps recorded in docs/PURE_ZIG_REFACTOR.md against upstream WebUI (webui-dev/webui at f1b28ee).

Lifecycle

• Running.wait() now follows upstream per-window semantics: a window that is closed on purpose ends immediately, an ordinary disconnect gets the 1.5 s reload grace period, and App.Options.startup_timeout (default 15 s, null waits forever) bounds the wait for the first connection to a shown window. Request activity extends that deadline, as upstream does.
• Running.requestExit() closes every window and wakes the waiter. Concurrent waiters get error.AlreadyWaiting.
• App.createWindow() also works while the app runs, like upstream webui_new_window. The new window gets fresh credentials, its folder, and its own folder monitor.
• App.destroyWindow() mirrors webui_destroy. It unregisters the window at once, so its routes answer 404, connected pages get a backend close, and later messages close the transport with 1001. It then cancels the window's handlers, monitor, and managed browser in the background. The window is freed after its last connection, request, and deferred reply, and Running.stop() finishes any pending cleanup. It is safe to call from the window's own handlers, through the new Client.window().
• Window state is now reference counted, and the window registry is guarded by a read-write lock. Each window has its own monitor task group, spawned with concurrent before the server starts.

Callback metadata

• Call.name, Call.origin (.call or .click), and Call.cookies / Event.cookies with cookie(name) expose the binding name, the call origin, and a per-connection copy of the upgrade's Cookie header.
• Cookie copies are bounded by Limits.max_cookie_size. Upgrades over the limit get 431.

Content and routing

• Default favicon fallback: favicon.ico and favicon.svg are resolved from the custom icon first, then a readable directory file, then upstream's built-in SVG. favicon.ico answers 302 to favicon.svg. This applies at both the capability root and the origin root.
• Content.site combines optional embedded HTML, a resource handler, a root folder, and an entry file. Requests resolve in upstream order: handler, then virtual-directory index probing, then root HTML, then folder files, then the default favicon or 404. A handler declines a path by answering an empty 404.
• Site.entry makes the root redirect to a validated relative entry file, like webui_show(window, "page.html").
• Plain .custom content now gets the same virtual-index probing.
• Window.installContent() replaces resources without navigating clients. If either the current or the new content is an external URL, it returns error.NavigationRequired.

Firefox app mode

• Firefox windows without a caller profile get a generated per-window profile, like Chromium windows. Before each launch it receives upstream's toolbar-hiding chrome/userChrome.css and a rewritten user.js. The user.js enables the stylesheet and turns off the default-browser check, the close warning, tabs in the title bar, and the first-run pages.
• high_contrast = false now works for Firefox through the browser.display.document_color_use preference. A caller profile is never modified, so with one Firefox still returns error.UnsupportedBrowserHighContrast.
• Snap Firefox cannot see the host /tmp. When /snap/bin/firefox exists, Firefox profiles move into the snap's user directory, as upstream does. The home directory comes from the passwd entry, because std.Io exposes no process environment.
• managedProfileDirectory and the profile helpers now take an Io.

Browser discovery

• Windows: Chrome and Chromium both install and register chrome.exe. Like upstream, a folder with Google's initial_preferences or master_preferences file is Google Chrome, and any other chrome.exe is Chromium. Registered Chromium is now found, and a Chromium chrome.exe is no longer reported as Chrome.
• macOS: discovery also checks ~/Applications, then looks up the browser's bundle identifier through Spotlight (mdfind), which finds the bundle wherever it is installed. Upstream uses open -R -a, which reveals the app in Finder. mdfind has no side effects. A missing or disabled index just finds nothing.

Native page titles

• Like upstream, each non-empty page title replaces the native host title. GTK listens to notify::title, WebView2 to DocumentTitleChanged, and Cocoa observes WKWebView.title through KVO. KVO also catches document.title changes after load, which upstream's didFinishNavigation misses. Options.title is the initial title, and setTitle applies at once until the page reports another one. An empty title keeps the host title, except that WebView2 reports its own default for untitled documents.
• Options.follow_page_title / Window.setFollowPageTitle() keep the title under host control, and Window.title() reads the host title. The native smoke checks following, setTitle, empty titles, and a window with following turned off, on every platform.
• The WebView2 close handler now uses a generic COM event handler that the title handler shares. @alignCast fixes the aarch64-windows native build.

Frameless drag and resize

• WebKitGTK: like upstream, a document-start script finds the nearest --webui-app-region value. Once the primary button moves over a drag area, it posts on a dedicated message channel and the host starts a window-manager move. The host checks that the primary button is actually held, so a page cannot move the window by posting on its own. Resizable frameless windows resize from upstream's 6 px edge band, with matching resize cursors.
• WebView2: enables ICoreWebView2Settings9 non-client regions, so CSS app-region: drag areas act as the caption (upstream PR #718). Runtimes without Settings9 report that drag regions are unavailable. Resizable frameless windows keep a WS_THICKFRAME sizing border.
• Cocoa: frameless windows are movable by their background, as in upstream, across style and kiosk changes.
• native.Window.dragRegion() reports the active model (.webui_property, .css_app_region, .window_background, or .none).
• The native smoke makes the first window frameless and uses real pointer input (xdotool on Linux, mouse_event on Windows). A drag must move the window, and a right-edge drag must widen it. On GTK, a forged drag message without a held button must not move the window. macOS reads back the background-movement setting, because synthesizing input there needs Accessibility permission. CI installs xdotool and passes --require-input, so missing tools fail instead of skipping. Breaking the button check, the move, or the edge resize each makes the smoke fail.
• Backend files are now included in zig build test, and the edge hit-test has a direct unit test.

Engine-level navigation decisions

• native.Options.navigation_handler / Window.setNavigationHandler() decide page and frame navigations in the engine, like upstream's WebKitGTK decide-policy handler, on all three backends (GTK decide-policy, WKWebView decidePolicyForNavigationAction, WebView2 NavigationStarting + FrameNavigationStarting). The handler gets a borrowed { url, kind } and returns false to cancel and keep the page.
• The host's own initial load and navigate() are not reported. Every server redirect hop is reported, because WKWebView has no public redirect flag and this is the only behavior consistent across engines. It also lets a handler stop a redirect to another origin. A URL that cannot be read cancels the navigation.
• The native smoke blocks a script navigation and a link click while the page stays alive, requires an allowed favicon.ico navigation to report its 302 hop to favicon.svg, and checks that a host navigation back is not reported. Mutations (no host exemption, ignored decision, and on GTK skipped redirects) each fail it on Linux and macOS.
• This closes the last open semantic gap; only the intentional default-presentation policy row remains.

Tests and tooling

• zig build test -Dtest-filter=<name> runs selected tests.
• Socket integration tests that were previously gated to Linux now also run on macOS. Only Windows skips them.
• Fixed a test race: a test changed client evaluation IDs before the client registration had finished.
• Fixed macOS CI races in the newly enabled socket tests. Shutting down a socket the server already closed is now tolerated. Tests wait for queued handlers and for client registration, because CHECK_TOKEN is acknowledged before the client is registered.
• App.destroyWindow() now sends the close notification before starting the background reaper. Before, a handler destroying its own window could be cancelled mid-broadcast on Linux.
• The authentication-deadline test pings for three seconds of wall time. Before, it used a fixed loop of 30 pings, which could outlast the five-second deadline on slow runners.

Validation

• zig build test (74/74) and zig build on macOS with Zig 0.16.0. The full suite also passed 40 runs with 8 copies in parallel.
• zig build -Dtarget= for x86_64-linux, aarch64-linux, x86_64-windows, x86_64-macos, and aarch64-macos
• rg 'webui_new|pub extern fn webui_' src finds nothing