Review fixes: swipe (capture-phase, enabled in TG), TG header aligns to the nav band, DnD zoom delay 1s->0.7s

- Edge-swipe back now listens at the window in the CAPTURE phase (the board's
  pointer handlers can't swallow it) and is no longer skipped inside Telegram
  (where the owner tests it).
- TG-fullscreen header: expose the device safe-area top (--tg-safe-top) and
  centre the title + menu pair within Telegram's nav band ([safe-top,
  content-top]) below the notch, keeping the band's height — lining up with
  Telegram's own controls.
- DnD auto-zoom-on-hover delay reduced 1000ms -> 700ms.

(Client-IP: diagnosed as the owner's home-router SNAT — the host caddy already
receives 192.168.0.1 with no XFF, so the real IP is lost upstream of our stack;
correct in prod. No code change.)

ui/src/components/Header.svelte

@@ -89,17 +89,18 @@
     transform: rotate(45deg);
     margin-left: 3px;
   }
-  /* Telegram fullscreen: TG's native nav overlays a band of height --tg-content-top at the top
-     of the viewport. Pull our title + menu up into the BOTTOM of that band and centre them as a
-     pair (hamburger right of the title) so they line up with Telegram's own nav controls rather
-     than floating above them (Stage 17). */
+  /* Telegram fullscreen: TG's native nav occupies the band between the device notch
+     (--tg-safe-top) and --tg-content-top. Our header spans that full band (so the layout below
+     is unchanged) and centres the title + menu as a pair (hamburger right of the title) within
+     it, BELOW the notch — lining them up vertically with Telegram's own back/menu controls,
+     which sit in the band's corners (Stage 17). */
   :global(html.tg-fullscreen) .bar {
     min-height: var(--tg-content-top);
     box-sizing: border-box;
-    align-items: flex-end;
+    align-items: center;
     justify-content: center;
-    padding-top: 0;
-    padding-bottom: 6px;
+    padding-top: var(--tg-safe-top);
+    padding-bottom: 0;
   }
   :global(html.tg-fullscreen) .spacer {
     display: none;