fix(miniapp): restore strict WebKit rendering and floating chat

[bobleer]

Summary

• load strict marketplace MiniApps from a sandboxed Blob URL after the host bridge is listening, avoiding blank srcdoc documents in Tauri WKWebView
• allow only local Blob and about:blank / about:srcdoc iframe navigations through the desktop navigation policy while preserving main-window reload blocking
• keep strict MiniApp Agent runs visible in the claimed floating composer when its session is bound, with a main-session fallback otherwise
• add frontend integration coverage and desktop navigation-policy regression tests

Fixes: N/A (manual regression report)

Type and Areas

Type: regression fix

Areas: desktop/Tauri, Web UI, MiniApp runtime, Agent chat bridge

Motivation / Impact

Reviewed marketplace MiniApps using the strict runtime could open as an entirely blank surface on macOS. Wry forwards subframe navigation actions to Tauri's URL-only navigation callback, so BitFun's one-shot main-window navigation guard also cancelled the MiniApp iframe's Blob navigation.

Strict MiniApps now render reliably in WKWebView without weakening their opaque-origin sandbox. Their contextual Agent workflow can remain in the floating chat composer instead of navigating away from the MiniApp when the active runner owns the bound session.

Verification

• pnpm --dir src/web-ui run test:run src/app/scenes/miniapps/components/MiniAppRunner.test.tsx src/app/scenes/miniapps/hooks/miniAppAgentVisibility.test.ts src/app/scenes/miniapps/hooks/useMiniAppBridge.test.tsx — 3 files, 7 tests passed
• pnpm run type-check:web — passed
• cargo test -p bitfun-desktop — 249 passed, 2 environment-dependent tests ignored
• cargo check -p bitfun-desktop — passed
• cargo build -p bitfun-desktop — passed
• git diff --check — passed
• Manual macOS desktop smoke test with an imported strict Market Lens package — dashboard rendered; clicking “Ask about this market” opened the floating chat composer and prefilled the contextual question

Reviewer Notes

• The desktop policy still rejects subsequent http, https, tauri, data, and other page navigations. Only local Blob documents plus about:blank / about:srcdoc bypass the one-shot gate without consuming it.
• The strict iframe remains sandbox="allow-scripts"; allow-same-origin was not added and the compiled MiniApp CSP is unchanged.
• AI-assisted implementation; fully tested as listed above.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable (no user-facing string or locale changes).