fix: never wedge or eat input — request timeouts, prompt restore, destroy confirm

[saucam]

What

Five input-safety fixes from a systematic audit of the TUI, all in the "never freeze, never lose what the user typed, never destroy without asking" family:

1. Requests are now bounded — the UI can no longer freeze forever

/fork, /provider, /destroy (and every other request_ok call) await inside the event loop. Previously ClientHandle::request had no timeout, and a socket death did not cancel pending requests — if the daemon died mid-request the TUI wedged permanently (no keys, no redraw; recoverable only by kill -9).

• request() now times out after 30s (ClientError::RequestTimeout), deregistering the entry so a late response hits nothing.
• A Drop guard on the reader task cancels every pending request the moment the socket dies — awaiting callers unblock immediately with RequestCancelled, they don't wait out the timeout.

2. The keyboard works during reconnect backoff

The backoff loop (~31s across 5 attempts) previously slept without polling terminal input: q/Ctrl+C were dead the whole time, and everything typed replayed into the prompt after reconnect. The wait loop now selects over terminal events — quit keys quit, everything else is discarded.

3. A slash typo no longer eats the prompt

take_prompt() drained the editor before parsing, so /reveiw <long message> or a send with no session focused destroyed the text with no recovery. Both error paths now restore the draft alongside the error.

4. /destroy asks first

The ConfirmDestroy modal existed (render + state + keymap comment) but was unreachable — /destroy (and aliases /close, /delete) destroyed instantly, errors ignored. Now: /destroy opens the modal; y destroys (surfacing daemon rejections instead of silently pretending); n/Esc/q cancel; every other key is absorbed so a stray keystroke can't confirm. /deny is one keystroke away from /destroy in the palette — this gate matters.

5. m (cycle mode) actually works

Bound in the keymap and listed in /help, but the reducer arm was info!("not yet implemented") — a silent no-op a user would trust before an unattended run. Now cycles interactive → guarded → autonomous; an unknown/missing mode starts at interactive (never jumps straight to autonomous).

Tests

• timeout path, socket-death cancellation, late-response deregistration (hand-built dead-end handle)
• prompt restore on parse error + on no-session send (multi-line draft)
• destroy: modal opens with the right session, y consumes + fires, n cancels; keymap absorbs stray Enter/letters
• next_mode cycle (incl. conservative unknown-mode start), quit-key classification

cargo test --workspace: 264 tui + 8 client tests green · cargo fmt --check clean

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 91.12272% with 34 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.87%. Comparing base (7e6b453) to head (6cc0efe).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
crates/codeoid-tui/src/app.rs	86.58%	33 Missing ⚠️
crates/codeoid-client/src/connection.rs	98.96%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #18      +/-   ##
==========================================
+ Coverage   68.24%   70.87%   +2.63%     
==========================================
  Files          32       32              
  Lines        7976     8319     +343     
==========================================
+ Hits         5443     5896     +453     
+ Misses       2533     2423     -110     

Flag	Coverage Δ
tui	70.87% <91.12%> (+2.63%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
crates/codeoid-client/src/request.rs	75.60% <100.00%> (+75.60%)	⬆️
crates/codeoid-tui/src/keymap.rs	93.05% <100.00%> (+0.83%)	⬆️
crates/codeoid-client/src/connection.rs	44.11% <98.96%> (+20.77%)	⬆️
crates/codeoid-tui/src/app.rs	48.03% <86.58%> (+9.19%)	⬆️

... and 3 files with indirect coverage changes