fix: restore mobile terminal scrolling

[almogdepaz]

summary

• force full history prefill when opening the first mobile session so scrollback is available
• derive touch-scroll sensitivity from the rendered terminal row height
• cancel touch momentum and return to latest output when opening the mobile keyboard
• add mobile regressions for issues Mobile terminal sometimes becomes unscrollable after switching sessions #163, Increase touch-scroll sensitivity for long terminal histories on mobile #181, and Opening the mobile keyboard should scroll to the latest terminal output #182

verification

• bun run typecheck
• bun test — 1,683 passed, 20 broker-dependent skips
• bunx playwright test — 78 passed, 117 expected project/broker-dependent skips
• focused regressions passed on iPhone SE and iPhone 14 Playwright projects
• git diff --check

closes #163
closes #181
closes #182

[almogdepaz]

edc delivery + security + quality review

scope: main@ed009b3...c6fcb2a (fix/mobile-terminal-scrolling)
context loaded: browser-client, server-api-runtime generated asset note, tests, known issues

delivery verdict: delivered
architecture fit: fits
security recommendation: approve
quality verdict: lean enough. ship.

delivery / architecture

no findings.

• first mobile session now forces full prefill via initTerminal(cached, "full") at public/app.ts:2796-2800, matching the stated first-open history requirement.
• touch scrolling now uses rendered row height instead of a magic 28px threshold at public/app-touch.ts:149-154.
• keyboard open cancels scroll momentum and returns to latest output through scrollToBottom() at public/app.ts:1911-1916 and public/app.ts:4226-4233.
• e2e coverage exercises first-open history, row-height scrolling, keyboard-bottom behavior, and the changed mobile fast-restore expectation at tests/e2e/mobile-scrolling.e2e.ts:92-156 and tests/e2e/session-switch.e2e.ts:430-457.
• generated src/public-assets.ts change is consistent with the public asset embedding contract.

security

no security findings.

checked:

• auth/authorization impact: none.
• validation/input boundaries: no new server-side untrusted input path; browser-only touch/keyboard behavior.
• external calls/filesystem/subprocess: none in production code.
• sensitive state mutation: only local ui terminal scroll state.
• history/regression scan: no removed security checks.

limitations: review was diff/context based; i did not run the mobile playwright suite locally.

quality

no blocking quality findings. the changed tests verify behavior through the real browser terminal path rather than a mock-only assertion, which is the right level for this timing-heavy mobile flow.