fix(web): avoid session misclicks during live reordering

[techotaku39]

Problem / Motivation

When the session list reorders while the pointer is held, releasing over a different session row can cause that row to be selected. This is reproducible in the Edge-installed Hapi PWA by holding on one session and releasing over another session row.

This PR is a refreshed, rebased continuation of #1099, originally authored by NPUlrk. It is based on the current main branch and retains the touch ghost-click protection from #1185.

Summary

• Prevent the legacy mouse path from synthesizing session selection during mouseup.
• Cancel pending long-press timers when the pressed row moves and no longer receives the release event.
• Preserve normal touch tap, touch long-press, keyboard, and native click behavior.
• Keep the touch ghost-click protection introduced by fix(web): stop touch taps from double-firing session navigation #1185.
• Add regression coverage for live reordering and release events landing outside the pressed row.

Validation

Passed:

• bun typecheck
• Root Playwright:
  pwsh -NoProfile -File .\\scripts\\Invoke-HapiTaskPlaywright.ps1 -Name investigate-edge-pwa-longpress-session-switch -Suite Root -TestArgs 'terminal-wrap-fidelity.spec.ts' — 2 passed
• Related Web tests:
  ..\\node_modules\\.bin\\vitest.exe run src/hooks/useLongPress.test.tsx src/components/SessionList.directory-action.test.tsx — 50 passed
• bun run build — passed
• bun run test:shared — 294 passed
• Manual verification of the reported Edge PWA flow on the task deployment — passed

The repository-wide suites were also run on Windows. They are not fully green because of unrelated platform-sensitive failures outside the changed files:

• bun run test stops during CLI tests at 2 unrelated Windows permission/path failures.
• bun run test:web — 266 files passed; 3 fixture files failed (76 tests) because of LF/CRLF canonical serialization.
• bun run test:hub — 1,199 passed, 3 skipped, and 6 unrelated Windows/path/config failures.
• bun run test:relay — 79 passed and 1 unrelated relay/package.json path failure.

Related Issues

• Refs #1099
• Related PR: fix(web): stop touch taps from double-firing session navigation #1185

AI Disclosure

OpenAI Codex (GPT-5.6) assisted with repository investigation, rebasing, implementation, test execution, and PR drafting. The changes and validation were reviewed against the source code and test results.

[github-actions]

Findings

• None.

Summary
Review mode: initial
No reportable issues found in the added or modified lines. Residual risk: the live-reorder regression is covered with synthetic DOM events, so browser-specific native click targeting remains dependent on the reported manual Edge PWA validation.

Testing

• Not run (automation). GitHub checks at review time: integration pass; test pending. Suggested follow-up coverage: a Playwright case that performs a real pointer press, reorders the keyed rows, and releases over the replacement row.

HAPI Bot