Fix mobile safe-area themes and keyboard focus

[Tryanks]

Mobile safe-area bands used the near-white T1 reading surface instead of the T0 window canvas. Use the existing opaque canvas for those bands and synchronize iOS/Android system-bar contrast and native fallback backgrounds with the resolved app theme, including explicit themes opposite to the OS setting. Content insets still have one owner and retain max(safe area, IME).

Software-keyboard devices now wait for a tap before focusing the composer at either width. Navigation dismisses focus, while rotation preserves active editing. Restoring an open terminal no longer steals focus through a deferred callback. This extends the existing window/input capability policy and updates docs/DESIGN.md.

Validation:

• The reporting user installed the signed ARM64 debug APK on their physical tablet and confirmed the behavior is correct.
• iPad iOS 26.4 and Android API 35 simulator checks covered themes, wide/narrow layouts, live theme changes and actual software-keyboard display after a tap, using isolated profiles. Screenshot pixel regression failed before the canvas fix and passed afterward: light safe-area RGB changed from (252,253,251) to T0 (242,244,247); dark edges match (21,23,28).
• Focus regressions were demonstrated red/green through production shell paths. They cover wide mobile drafts, navigation, cold restore, deferred terminal focus, explicit taps and preserving editing focus during reflow. Final UI validation passed 396 unit tests, 1 integration test and Clippy.
• Pre-rebase workspace formatting, Clippy, build and tests passed; the full-workspace test run preceded the final terminal-focus patch. Final local iOS, Android and Web checks passed with RUSTFLAGS='-D warnings'; both native packages built successfully. cargo-machete . 0.9.2 passed after the local cargo machete entry point misinterpreted its subcommand as a directory. macOS debug linking reported a large unwind-table warning and dependency block reported future incompatibility.
• Rebased onto current main without conflicts; git range-diff confirms the accepted patch is unchanged and formatting passes after rebase. Final-head CI passed all six jobs (Plan CI scope, Dependency hygiene, macOS arm64, Linux x64, Windows x64, and Mobile and web checks) on f9a4e5e4765461f1b57a73851ec3a05493934c59: run 34331985107, attempt 2. Windows initially failed the existing pipelined_request_and_chunk_trailers_never_reach_origin proxy test with ConnectionReset (10054); one diagnostic rerun without code changes passed that test and all 11 proxy integration tests. The reset root cause remains unproven; this PR does not claim to fix a network race.

Other OEMs, older Android APIs and the complete real-device restored-terminal matrix were not exercised. APKs and local screenshot/probe artifacts are not included in this PR.