fix(mobile): settle tunnel startup once and improve touch accessibility

[fengnanrui]

Summary

• Make Quick Tunnel startup settle exactly once, with per-stream bounded buffers so URLs split across output chunks are recognized without concatenating stdout and stderr.
• Ignore the control API hostname and reject hostname suffixes; detach startup listeners and cancel the deadline after settlement. Failed startup uses the existing SIGTERM/SIGKILL cleanup helper, and late output cannot announce a failed tunnel as online.
• Keep the mobile bridge page zoomable, provide visible keyboard focus, respect reduced motion, and use 44px coarse-pointer targets with 16px form controls.
• Document the lifecycle / UI contracts and correct the dependency version in the development guide to match package.json.

Validation

• npm ci completed including postinstall patches.
• npm run typecheck and npm run build passed.
• Full npm test: 112 files, 959 tests passed.
• New process-boundary regressions cover fragmented URL output, independent stdout/stderr, timeout, late error/output, listener/timer cleanup, and hostname validation.
• Chromium layout smoke at 320×568, 360×640 and 640×360: no horizontal page overflow; coarse-pointer target dimensions and zoom permission checked. This used a locally rendered page with network blocked, so it is layout evidence, not a public-tunnel or pairing acceptance test.
• git diff --check passed.

Tested on macOS arm64. Windows process behavior, a real external Cloudflare tunnel, and physical-phone end-to-end pairing were not manually validated in this change. No desktop profile or user credentials were reset.