refactor(ui): move the composer onto ChatComposerInput

[Astro-Han]

Summary

Refs #1861 (slice 3). Replaces the composer's hand-rolled <textarea> stack with Astryx's ChatComposerInput, a contentEditable that already owns the trigger menu, inline tokens, prompt history, and paste-as-token. Four self-built modules retire with it — use-mention-popup.ts, composer-mention-popup.tsx, and the mention popup's CSS and contract tests.

What the port buys, beyond deleting a parallel implementation:

• Inline tokens. A picked @ mention is a chip in the draft, not raw text the user can half-delete. It serializes to its path on send.
• useChatPasteAsToken. A reference-sized paste folds into an expandable chip instead of flooding the input. Hosts that stage quotes (the main composer) keep getting QuoteRef drawer chips; the quote companion, which wires no onPasteAsQuote, now gets the inline chip for free.
• One trigger grammar for @ and / instead of our own detectMentionTrigger.

Skills selection, permission mode, voice capture, and drag-and-drop stay on the outer composer, unchanged. Each is covered by an existing E2E journey that still passes.

Defects found and fixed here

Six independent reviews of the port — four subagents plus Codex and Kimi K3 — turned up defects a reviewer reading the port alone would not see. Each of the following is fixed in this PR and pinned by a test verified to fail without its fix.

Alt+Enter destroyed the draft. ChatComposerInput's Enter branch exempts only Shift, then clears the editor before ChatComposer's submit guard decides nothing was sent. Both modifiers now insert the break themselves.

A break at the end of a draft vanished. A scripted Range insertion of \n landed at the root level, where Chrome collapses a trailing newline. execCommand('insertLineBreak') produces the <br> Astryx serializes, and keeps the caret and the native undo stack intact.

The IME guard was in the wrong place. It sat in the onKeyDown we pass down, but ChatComposerInput runs its trigger menu first and that branch has no isComposing check. The guard is now a native listener on the component root: React 19 delegates at the root container, so stopping propagation there takes the key away from every React handler at once, ours included.

The trigger menu did not follow the caret. Astryx recomputes the active trigger only from input, so an arrow key off the query left the menu open over a trigger no longer under the cursor — and the next Enter spliced a token in at the stale offset and swallowed the send. Typing 看一下 @agent, pressing ArrowLeft six times, then Enter produced 看一下 <token> @agent and sent nothing. The retired popup tracked this with a selectionchange listener; this is that listener, replaying one input event so upstream re-derives the trigger from its own grammar rather than from a copy of it.

A restored draft lost the caret. Upstream restores the caret to the end only when a controlled update lands on a focused editor, and switching sessions swaps the draft while the composer is blurred — so the next keystroke prepended to the restored text. The textarea did this unconditionally on the same two paths (draft swap, history recall); so does the port now.

The file search never implemented cancel(). useTriggerMenu calls it before every real search and on reset, and we simply did not provide it, so a slow query could land its results behind a newer one. The same seam replaces the probe cache: upstream's per-keystroke search('') reads nothing but instanceof Promise and discards the value, so the probe is now answered from a resolved constant, and the bare-@ listing is no longer served from a promise that outlived the files the user created while composing.

A no-break space reached the backend. insertToken anchors a chip with U+00A0, and its own backspace-eats-the-token check keys on that exact codepoint — so the editor keeps it and only the wire is normalized.

Verification

Full desktop E2E, unit, and static checks on the rebased branch:

$ npx playwright test -c e2e/playwright.config.ts
  82 passed (46.8s)

$ npm test --workspace=@maka/ui
ℹ pass 238   ℹ fail 0

$ npm run typecheck && npm run lint && npm run format:check
(clean)

$ node scripts/check-dead-css.mjs --check
check-dead-css: no dead classes or tokens found ✓

The two risks named in the issue were verified directly:

Chinese IME + Enter. Covered by send-message.spec.ts, which dispatches the composition with isComposing: false on purpose — only the composition we track ourselves can stop that Enter, so a passing test cannot be crediting the component's own native check. Also exercised by hand with a real CJK IME, which Playwright cannot synthesize.

E2E selectors assuming <textarea>. COMPOSER_INPUT targets the contentEditable, and assertions moved off toHaveValue. Fourteen spec files touched.

Three assertions could not observe what they claimed

Worth calling out, because the failure mode is not obvious: Playwright normalizes whitespace in every text matcher. getByText matched a U+00A0 against a plain space, and toHaveText matched a newline against a space. So the NBSP fix and both Shift/Alt+Enter cases passed with their production fix deleted, and the empty-menu case asserted zero sends immediately after the Enter that would leak one, then hid the leak by sending the same text twice. All four read raw textContent or pin a message total now.

Every fix in this PR was mutation-checked: the guard, branch, or listener was removed, the workspace and renderer rebuilt, and the suite re-run to confirm the test goes red.

Review focus

One capability is deliberately lost. The retired detectMentionTrigger allowed a space inside an @ query (@foo bar narrowed the search). Astryx's findActiveTrigger treats a space as the end of the query, so that no longer works. Adopting the upstream grammar rather than forking it is the point of the slice, so the boundaries we now depend on are pinned by a contract test — an upstream change that moves one fails there instead of in front of a user.

One upstream gap remains, deliberately unfixed. findActiveTrigger accepts only ' ' and '\n' as a trigger boundary, but insertToken anchors a chip with U+00A0 — so typing @ immediately after a chip opens no menu until the user types a space. The boundary set is internal to useTriggerMenu; the fix is a one-line Astryx patch, and rewriting the character on our side would break useChatComposerTokens' backspace-eats-the-token check, which keys on that exact codepoint. Documented at the call site.

Two narrower edges are accepted rather than fixed. An inline token degrades to plain text when a draft or history entry is restored, because the controlled value is a string — the wire form is identical, so this is cosmetic. And a clipboard carrying both files and text loses the text if it is pasted while the composer is disabled or streaming.

Out of scope

• Tokenized message bubbles — slice 4, which depends on this landing.
• User-bubble CSS — slice 1.