fix: bridge app-local keyboard shortcuts into WKWebView

[daniele21]

Outcome

Route ClosedRoom's app-local keyboard events through the native AppKit window boundary before they enter WKWebView, preserving the existing frontend keydown behavior while making Cmd-K and Escape deterministic for the packaged macOS app.

Evidence / root cause

On exact candidate 23dafebbc4f2c00a0b92496fe73085387ef6ee1f, the repository-owned target-Mac diagnostic completed with shortcut_delivery_failed_search_ui_healthy:

• ClosedRoom active, visible, key/focused window healthy before and after Cmd-K;
• Search control present;
• PID-targeted Cmd-K did not open Search and focus remained AXWebArea;
• AX press on the same Search control opened the dialog and focused AXTextField;
• PID-targeted Escape also did not close the dialog.

This isolates the failure to synthetic AppKit -> WKWebView keyboard delivery rather than Search state, window activation, AX exposure, or the React Cmd-K listener.

Implementation

• install one app-local NSEvent key-down monitor owned by ClosedRoomWindowManager;
• only bridge when the main ClosedRoom window is the key window;
• bridge Cmd-K and Escape into the currently focused DOM path as bubbling/cancelable KeyboardEvent instances;
• preserve the original native event so real keyboard delivery remains additive and normal WebKit behavior is not suppressed;
• remove the monitor during window-manager cleanup;
• keep the existing REAL_ENVIRONMENT checks unchanged (key(pid, "cmd-k"), focus assertion, key(pid, "escape")).

Product / privacy

• PRODUCT_LOCAL: preserves an already-settled shortcut contract rather than adding a new feature;
• no meeting data or content crosses the native bridge;
• no cloud processing, remote fallback, or external transfer;
• no capture, persistence, transcription, inference, or storage behavior changes.

Four axes

• PRODUCT: PRODUCT_LOCAL
• DELIVERY: INTEGRATION
• VALIDATION: repository selector authoritative; native packaged keyboard boundary requires at least the selected automated profile plus fresh REAL_ENVIRONMENT after integration
• EXECUTION: REMOTE_AUTOMATED + REAL_ENVIRONMENT for the target-Mac shortcut/focus path

Release PR #49 remains blocked and must not be merged; any eventual integration changes the exact dev candidate and invalidates prior exact-HEAD release evidence.