…moved, persisted usage stats, plan dispatch gate

Headline themes:
- Desktop: bundle the CLI-hosted React dashboard, retire Tauri+Preact duplicate (#1418)
- Config: drop preset abstraction; flash/pro are direct model selections (#1657, #1630)
- Stats: persist cumulative usage to session meta + auto-restore on startup (#1667, #1680, #1643, #1628)
- Plans: editMode="plan" enforced at the ToolRegistry dispatch gate (#1681); step advance fix (#1629)
- Context: fold once at turn start, drop pre-flight + byte-ceiling (#1642, #1646); collapsible compacted card (#1649)
- Subagents: per-skill flash/pro override + Settings UI (#1632)
- Desktop polish: sidebar drag-resize (#1688), responsive collapse (#1585), copy/edit overlay + msg-history nav (#1645), Esc closes modal not turn (#1685), QQ tab isolation (#1672), DiffCard for edits (#1662), theme-aware highlighting (#1655), system events toggle (#1654/#1650), macOS TCC inheritance (#1614), dashboard.enabled (#1612)
- Dashboard polish: persistent session URL (#1586, #1589, #1599), theme-aware highlighting (#1664), IME confirm-enter guard (#1689), code-fence lang fix (#1677), vendor chunk split (#1587), markdown table h-scroll (#1562)
- TUI: Alt+S input stash/recall; static history isolated from input rerenders (#1635); legacy mouse drop (#1637, #1648); multi-edit gated in review (#1647)
- Diff: SplitDiff column border holds under CJK (#1686)
- MCP: workspace roots passed to servers (#1625); codeCommand honors mcpServers (#1603)
- Config plumbing: (baseUrl, apiKey) resolved as a tuple (#1658); stale model id self-heal (#1663)

See CHANGELOG for the full list.

#1637 handled the canonical ESC [ M ... legacy mouse form, but Windows
ConPTY can strip the leading ESC, leaving a bare [M... that fell back to
the printable-text path. A burst of these (e.g. holding the mouse over
the terminal) would keep growing composer state — residual of #1598.

Add tryEscapelessLegacyMouse() parallel to the existing escapeless SGR
mouse path: recognize [M + 3 payload bytes as a fixed 5-byte packet,
consume it, surface no input event. Wire it into both the main parse
loop and the printable-run terminator so a stray [M mid-typing breaks
the run instead of swallowing the report into text.

Tests cover: single packet dropped, 1000-packet flood produces no
events, printable text either side of a report stays intact.

Trade-off: literal user input of "[M" followed by exactly 3 chars is
also swallowed — but [M is not a realistic typing pattern and the
flood-protection win is worth it.

Thanks @GTC2080 for tracking down the residual case.