feat(chat): two-way composer draft sync across desktop and mobile

[Adam-Dalloul]

Merge order

1. This PR first (#479, text-only draft sync)
2. Then desktop #483 (images/files on the same draft)
3. iOS #6 pairs with this PR (needs these endpoints)
4. iOS #7 stacks on iOS #6 and pairs with #483

#483 includes this commit. Merge this on its own; do not squash #483 first.

---

Unsent composer text is localStorage-only today, so a sentence typed on desktop is gone on the phone (and the other way around).

This persists the visible composer string for a persisted conversation and syncs it last-write-wins, same origin+revision pattern as tabs://changed.

Security

• Authenticated get_composer_draft / put_composer_draft only.
• Only real conversation ids (get_by_id). New-tab draft: keys stay local.
• 256 KiB UTF-8 cap. Origin is 1-64 [A-Za-z0-9_-].
• The WS notify is ids only (conversation_id, revision, origin, cleared). The body is never on the firehose, so a WS/log dump cannot leak what the user is typing.
• Empty text is a tombstone so a clear on one device wipes the other.
• No logging of draft text.

Clients

Desktop/web: after the existing 300ms local draft save, PUT the visible text. On open / reconnect / notify, GET and apply if the revision is newer and origin is not this browser.

iOS native follow-up is #6 on codeg-ios. A phone using the web UI is covered by this PR alone.

Tests

• Origin / size / missing-conversation / put-get-clear in conversation_composer_draft_service.
• WS payload has no text field.
• composer-draft-sync.test.ts for key parsing and echo suppression.

No secrets. One concern.