feat: swipe through mux tabs and sessions, scope foreground reconnects

[patricio0312rev]

feat: swipe through mux tabs and sessions, scope foreground reconnects

🔥 What's New:

• The sideways terminal swipe now walks a ring: the tabs of the bound multiplexer session first, then the host's other tmux/herdr sessions, then the app's other connections, wrapping at both ends. Tab and session hops run over the control channel (tmux select-window / switch-client -c, herdr tab focus) and show a bottom toast naming the landing; herdr cannot move an attached terminal between sessions, so those hops skip with the detach hint and the gesture falls through to the next connection.
• The ring never acts on unverified state: unknown attachment, ambiguous tmux clients, or stale bindings skip instead of moving another terminal's client. The mux topology (session list plus the bound session's tabs) is cached atomically per generation so a swipe never blocks on a remote round trip and stale refreshes are dropped.
• Foreground recovery no longer redials every registered session. Only sessions with a live surface in a presented workspace auto-dial, active session first, so a closed passphrase remote can no longer throw its Face ID prompt over an unrelated session. Left-behind sessions redial when the user returns to them, and closing a session settles the registry before any await so a hung socket cannot leave a redialable ghost.

🕵️‍♂️ QA Testing:

1. Swipe ring: connect to a host running tmux with several sessions or windows (mock: SCENARIO=sessions.workspace.tmuxCluster make run). Swipe left repeatedly: current session's windows first ("Switched to "), then the other tmux sessions, then the next app connection sliding in. Swipe right walks the same ring backwards. On an attached herdr host the swipe shows "Detach to switch sessions" and moves on to the next connection.
2. Auth fix: open a session on a remote using a passphrase-protected key, close it (or go back to Remotes), open a session on a password remote, lock the phone, unlock. No Face ID prompt for the closed remote; only the visible session reconnects.

Verified with 1001 package tests in 212 suites, make lint, clean codex review against dev, and a simulator walk of the full ring in both directions.