feat(web): window-wide wallpaper driven by the active pane's scope

[oorabona]

What

Move the wallpaper from a per-terminal-pane background to a single window-wide layer behind the whole
app, resolved from the active (focused) pane's scope (host+channel cascade). Since one active host
scopes the window, this is unambiguous and follows tab/pane/host focus. All 4 region opacity sliders
(terminal/sidebar/hostRail/tabBar) now act as "glass" over the one wallpaper, so they all become
meaningful — previously only the terminal had a backdrop.

How

• useActiveWallpaper: active tab → focused pane channel → its host → the existing per-scope cascade
  profile (useResolvedProfile) → the existing useWallpaper styles (backgroundImage + blur + dim).
• App.vue: one wallpaper layer at z-index: 0 behind a transparent .app-layout (z-index: 1);
  .app-root owns the --nt-bg fallback.
• TerminalPane.vue: removed its own wallpaper-bg/wallpaper-dim + useWallpaper; the terminal
  background stays glass (rgba(var(--nt-bg-rgb), var(--nt-terminal-alpha))) so the window wallpaper shows
  through it. Per-scope wallpaper config + the opacity sliders are unchanged.

Correctness (caught by the orthogonal gate, all fixed before merge)

useResolvedProfile is now app-lifetime + reactive, which surfaced several state-correctness issues:

• Auth: skip the fetch when the token is null/blank (no Bearer null before pairing / Tauri token
  load); watch the token and reload when it becomes available / rotates.
• Wrong-host context: never substitute channelsStore.activeHostId for an unmapped active channel
  (could merge another host's profile after restoring persisted tabs before the channel→host map is
  rebuilt) — resolve host-less (global cascade) until the mapping is known, then correct reactively.
• Stale profile: clear to DEFAULT_PROFILE + resolvedFor=null on token loss and on a context change
  before reload (same-context refresh doesn't flash); commit a fetched profile only if request seq + token
  • context still match. A reused pane / token rotation / context switch never applies another channel's
    or session's profile/wallpaper.

Verification

• vitest packages/clients/web → 778 passed / 0 failed; vue-tsc clean; biome check clean (93 files).
  New tests: active-wallpaper resolution + unmapped-channel host omission; useResolvedProfile token-gating,
  reload-on-token, stale-clear on context/token change.

Gate

Orthogonal pre-PR gate: codex = CLEAN (after fixing its findings across 2 rounds); copilot exogenously
unavailable. Degraded GATE_OK.

Visual change — please confirm in the browser: set a wallpaper, lower a region opacity (terminal /
sidebar / etc.) and the one window wallpaper shows through each region; switching host/tab updates it.