feat: add bounded semantic hover

[SarthakWade]

Summary

• add hover as a semantic CLI, wire protocol, MCP, and SDK command using ref or role/name targets
• dispatch trusted pointer movement through Chromium CDP and bounded synthetic pointer/mouse transitions in WKWebView
• surface login forms revealed by hover through the existing AUTH_REQUIRED challenge flow
• document engine behavior and track drag separately in Design bounded semantic drag interactions #208

Security

• preserve the private Unix-socket transport and existing navigation policy
• reject missing, conflicting, stale, hidden, detached, and obscured targets before dispatch
• keep page-derived coordinates internal and exclude hover from flow recording
• validate target unions before transport in the generated TypeScript and Python SDKs

Testing

• pnpm test
• pnpm test:runtime
• pnpm test:npm
• Python generator, Ruff, strict mypy, and pytest (42 tests)
• Rust protocol tests and Clippy
• pnpm build
• pnpm test:e2e:linux
• targeted macOS WKWebView hover, navigation, and authentication E2E paths

Closes #35

[yashranaway]

Thermo-nuclear + deslop: defer.

Per prior flag and PR body, edge + refresh behavior for hover still undefined. If hover reveals auth/forms but refresh invalidates refs without revalidation (like #212 does), we risk stale revealed surface. Also flow recording exclusion needs explicit decision.

Blockers before merge:

1. Refresh / stale / hidden / obscured revalidation for hover
2. Obscured-target check before dispatch (dropdowns often obscured)
3. Document why hover never records in flow vs screenshot series

Code otherwise clean, protocol +2 minimal, no rewrite needed. Re-approve once 1-3 clarified.