Review fixes: swipe (capture-phase, enabled in TG), TG header aligns to the nav band, DnD zoom delay 1s->0.7s

- Edge-swipe back now listens at the window in the CAPTURE phase (the board's
  pointer handlers can't swallow it) and is no longer skipped inside Telegram
  (where the owner tests it).
- TG-fullscreen header: expose the device safe-area top (--tg-safe-top) and
  centre the title + menu pair within Telegram's nav band ([safe-top,
  content-top]) below the notch, keeping the band's height — lining up with
  Telegram's own controls.
- DnD auto-zoom-on-hover delay reduced 1000ms -> 700ms.

(Client-IP: diagnosed as the owner's home-router SNAT — the host caddy already
receives 192.168.0.1 with no XFF, so the real IP is lost upstream of our stack;
correct in prod. No code change.)

ui/src/lib/app.svelte.ts

@@ -14,6 +14,7 @@ import {
   onTelegramPath,
   telegramColorScheme,
   telegramContentSafeAreaTop,
+  telegramSafeAreaTop,
   telegramDisableVerticalSwipes,
   telegramHaptic,
   telegramLaunch,
@@ -238,6 +239,7 @@ function syncTelegramSafeArea(): void {
   if (typeof document === 'undefined') return;
   const top = telegramContentSafeAreaTop();
   document.documentElement.style.setProperty('--tg-content-top', `${top}px`);
+  document.documentElement.style.setProperty('--tg-safe-top', `${telegramSafeAreaTop()}px`);
   document.documentElement.classList.toggle('tg-fullscreen', top > 0);
 }
 
@@ -279,6 +281,7 @@ export async function bootstrap(): Promise<void> {
     syncTelegramChrome();
     syncTelegramSafeArea();
     telegramOnEvent('contentSafeAreaChanged', syncTelegramSafeArea);
+    telegramOnEvent('safeAreaChanged', syncTelegramSafeArea);
     telegramOnEvent('fullscreenChanged', syncTelegramSafeArea);
     telegramDisableVerticalSwipes();
     try {