fix(miniapp): isolate agentic floating chat sessions

[bobleer]

Summary

• Bind MiniApp composer drafts to the host-validated topic session and activate that exact session before opening the floating chat.
• Fail closed for Agentic MiniApps during claim/session bootstrap or reload, so the shared ChatPane never mounts an ordinary or unrelated session.
• Restore the previous ordinary host session safely when the bubble closes, while preserving explicit navigation and rejecting foreign session bindings.

Type and Areas

Type: Regression fix / UI behavior / test

Areas: Web UI, MiniApp bridge, floating chat session routing

Motivation / Impact

Agentic MiniApps own a dedicated floating conversation. A fast focusSession + setComposerDraft sequence, or a temporary composer-claim gap during loading, could previously expose an unrelated normal conversation or open an empty surface. This change makes the MiniApp session identity authoritative and keeps the surface pending until that exact session is active.

Verification

• pnpm run type-check:web — passed
• pnpm --dir src/web-ui run test:run src/app/layout/floatingMiniChatIsolation.test.ts src/app/scenes/miniapps/hooks/useMiniAppBridge.test.tsx src/app/scenes/miniapps/miniAppStore.test.ts src/flow_chat/components/toolbar-mode/toolbarModeSessionSurface.test.ts — 4 files, 40 tests passed
• git diff --check — passed

Reviewer Notes

AI-assisted implementation. The PR is isolated from the unrelated dispatch refactor branch and contains only the seven Web UI files required for this contract fix. No user-facing strings or locale resources changed.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.