fix(commander): mouse-tracking reports flood the input queue and stall typing

[SmolSmolStar]

Summary

Typing in the Commander panel lags by seconds whenever the mouse is moving. Root cause found by measurement, not guesswork.

Root cause (measured)

Claude Code's TUI enables mouse reporting, so every mouse movement over the Commander terminal emits an SGR/X10 mouse report (ESC[<…M). The Commander sends each input as its own chained HTTP POST to /api/commander/input, and keystrokes share that same serial queue. So a burst of mouse reports piles up ahead of a typed character and delays it.

Instrumented /api/commander/input with a redacted probe (logs only the kind of input — mouse / printable / etc., never the characters) and had the user type while moving the mouse:

• Before: ~330 mouse reports vs a handful of printable keystrokes — keystrokes queued behind the flood.
• Typing in isolation (no mouse) was already fast, confirming the queue-contention diagnosis rather than "HTTP is slow."

Fix

The Commander is keyboard-driven, so drop terminal mouse-tracking reports in handleTerminalData before they're forwarded. The detector is ^-anchored to match only actual mouse sequences (SGR ESC[<…M/m and X10 ESC[M…) and leaves arrow keys, bracketed paste, and normal input untouched (unit-checked against those shapes).

Test plan

• Re-ran the same measurement on a real session after the fix: mouse reports reaching the server went from ~330 → 0, with the six typed characters flowing at ~90ms spacing.
• Verified the detector matches SGR/X10 mouse reports and does not match arrow keys, Enter, plain text, or bracketed-paste sequences.

🤖 Generated with Claude Code

[web3dev1337]

Reviewed as part of an open-PR sweep. The diagnosis (serial HTTP input chain flooded by mouse reports) was verified correct, but the filter was too broad: it dropped clicks, drags, and scroll-wheel reports too, killing mouse interactivity for mouse-aware apps in the panel. Pushed a fix: only idle-hover motion reports (motion bit set, no button held) are stripped, in both SGR and X10 encodings; stripping per-report instead of dropping the whole chunk also preserves keystrokes coalesced into the same data event. Added tests/unit/commanderPanel.mouseFilter.test.js (5 cases, passing). Verdict after fix: good to merge.