feat(tabs): grouped vertical rail from owner tab layouts

[aakhter]

This is the first of a short stack that gives the vertical tab rail named groups, built on the owner tab-layout API that already shipped as backend only (GET/PUT /api/tab-layout).

It adds a small pure module, tab-layout-browser.js, that reads GET /api/tab-layout, projects the owner's groups onto the live sessions and open web tabs, and renders them as collapsible sections in the vertical rail. The browser never writes the layout in this PR. Creating, renaming and moving tabs between groups come in follow-ups.

No change for existing users. Grouping only applies when the rail is vertical and the owner has at least one group. With no layout, a failed read, zero groups, the horizontal strip, phones or the sidebar, the rail markup is byte-identical to today. A test renders the old and new code side by side and compares them.

Grouping only changes how rows are drawn.

• sessionOrder, Alt+N, Ctrl+Tab and the palette keep reading the server-projected order.
• Each grouped row reuses the flat row's markup, so its badge still names its Alt+N key.
• In webview-tabs.js the only change is a small extracted renderWebviewTab(), with identical markup.

Collapse is a per-device preference in localStorage. A collapsed group always keeps the active row visible, selecting a hidden session reveals just that row, and lineage arcs to a hidden session anchor to its group header.

Drag-reorder is off in the grouped rail until grouped editing lands, because a flat-order drop can't express a move between groups.

There are no server changes, no new settings and no new SSE events. The page refreshes the layout on the existing tab:layoutChanged event (owner-scoped, newest version wins).

Tests

• Two new test files cover the projection, the markup, collapse storage, load sequencing and the app integration, including the byte-identity check.
• @vitest-environment jsdom currently fails on master (No such built-in module: node:), so the rail test runs the real modules in an explicit JSDOM window rather than relying on it.
• typecheck, lint, format, frontend-syntax, public-assets, browser-excludes and build all pass, plus 28 related test files.
• Checked in Chromium against an isolated instance: flat rail with no groups; a group created through the API appears live over SSE; collapse persists across reload; removing the group returns the exact flat markup.

Open questions for review

• With the default activity sort, rows sort within each group, so Alt+N badges may not count 1, 2, 3 down a group.
• Group headers are plain buttons for now; tree/treeitem semantics come in the next slice.