Align WebXR input hardening with upstream Quest controls

[Sythos]

What this PR does

This follow-up is rebuilt on the current upstream main and keeps the owner’s XR behavior as the source of truth. It adds a small capability and lifecycle hardening layer without changing the upstream keybinds or adding a DOM overlay.

• Keeps the upstream public/webxr.js module layout; no .mjs rename.
• Preserves the current Quest controls: right thumbstick primary for movement and turning, left-stick fallback, right trigger or A to fire, and B or grip to jump.
• Preserves the owner’s shortcut: pressing either thumbstick leaves XR and opens Settings.
• Adds capability-based input readiness for one complete physical controller or the preferred left/right pair.
• Accepts a Bluetooth/Xbox-like standard Gamepad when it covers movement, turning, firing, and jumping.
• Clears stale XR input on visibility changes, controller loss, and session teardown.
• Lets select/squeeze events supplement the corresponding Gamepad buttons.
• Prevents keyboard, mouse, touch, and desktop-gamepad paths from bypassing the physical-input gate while XR is active.

No small Exit VR DOM Overlay is added. The existing upstream exit paths remain unchanged. WebGPU, WebVR polyfills, and unrelated renderer behavior are outside this change.

Platform scope

BZO remains browser-only. Meta Quest is the primary target; desktop Chrome or Edge with SteamVR/OpenXR is an optional validation path, not a runtime dependency. iOS/iPadOS and visionOS/Apple Vision Pro immersive mode remain outside the current physical-controller support contract.

Testing

• npm run check passes, including server syntax, lint, documentation checks, shot-limit tests, and the WebXR capability tests.
• The capability tests cover the upstream right-stick-primary mapping, left-stick fallback, single-controller coverage, dual-controller coverage, event-button fallback, and incomplete-device blocking.
• Real-headset validation remains a separate follow-up; this update does not claim a new hardware run.

Closes #2

[Sythos]

Small follow-up on the Node 18 check: the only failure was the test loader treating the WebXR module as CommonJS on Node 18.19.1, while Node 24 auto-detected it as ESM. I made the boundary explicit by renaming it to webxr.mjs and updating the browser/test imports; both Node compatibility jobs are green now. The emulated immersive-vr session test passes too. I can't repeat the last step on a real headset from here, so real Quest validation is still the one bit I can't personally confirm yet, but the code path should now be covered cleanly by CI.

[timriker]

I made some changes to restore controls add an exit button, this no longer applies cleanly. Is some of this still desired?

[timriker]

I'm unclear what exactly this patch does other than add documentation.

It looks like it stops keyboard and game controller input in XR mode. That is not correct. A Quest, for example, can bluetooth pair to game controllers, mice, and keyboards. All inputs that are present should be allowed.

What does the patch do? ie: what is broken before and fixed after? or what functionality was not there that this adds? The description above us useless. It goes on and on about all the things it does NOT do. Remove all of that. the description should state clearly the things it DOES do.

Also, how are you testing this? What devices are supported?