fix: MiniApp interaction polish — backdrop close routing, publish-by-name

[bobleer]

Two host-side fixes surfaced while testing a MiniApp (the BaZi chart app).

1. fix(web-ui): close floating mini chat backdrop on click, not mousedown

Problem — with the floating mini chat open over a MiniApp, clicking a blank area of the MiniApp closes the bubble, but afterwards the MiniApp stops responding to hover entirely and it takes one extra click before clicks land in the app again.

Root cause — the fullscreen bitfun-fmc__backdrop closed the panel on onMouseDown; the backdrop is conditionally rendered on isOpen, so it was unmounted in the middle of the press gesture. Pulling the hit target of an in-flight gesture out from over a cross-document iframe corrupts the webview's hover/hit-test routing: mousemoves keep routing against the stale layer and the next click is spent re-hit-testing.

Fix — close on onClick so the gesture completes on the backdrop before it unmounts. A backdropArmedRef armed on mousedown (only when phase === 'open') preserves the existing opening-phase protection: a press that began while the panel was still scaling up can never close it on release.

2. feat(agentic): resolve PublishMiniApp target by display name

Problem — asking the assistant to “publish 循天问命” sent it digging through the filesystem with find/glob: the tool required app_id and its own description pointed at “the directory name under the miniapps data root”, while the installed roster sat in the running MiniAppManager all along.

Fix

• New app_name parameter: matched case-insensitively against manifest names in every locale (exact first, substring fallback); app_id becomes optional.
• Every failure path (unknown name, ambiguous name, bad id, neither given) returns the installed id — name roster, so the model self-corrects on the next call instead of searching disk.
• Tool description now explicitly says to resolve through the manager and never search the filesystem.
• Screenshot validation moved after app resolution: a name-only call confirms the app first, then asks the user for screenshots.
• Permission identity falls back to app_name.

Verification

• tsc --noEmit clean (web-ui).
• cargo test -p bitfun-core miniapp_publish — 6/6 pass (locale matching, substring fallback, ambiguity, schema/permission contracts).
• Manual: bubble close now leaves MiniApp hover/click fully responsive; the closing click itself is swallowed (standard overlay semantics).