fix(app): unstick iOS image picker and land reusable Maestro primitives

On iOS, tapping "+" → "Add image" in the Composer left an invisible
backdrop trapping touches after the native photo picker dismissed. Root
cause: the dropdown menu's onSelect fired while the RN Modal was still
completing UIKit dismissal, so PHPicker presented over a dismissing
Modal that never cleanly released.

DropdownMenu now defers the selected item's onSelect until Modal
onDismiss (UIKit-level completion) plus a short buffer on iOS, then
invokes it. Same DropdownMenu instance — no per-call opt-in.

Along the way, the Maestro repro surfaced a controlled-TextInput
character-drop race: fast inputText on a controlled input drops
characters mid-type. Direct-host and pair-link inputs are now
ref-backed uncontrolled inputs with stable testIDs.

New reusable E2E primitives under packages/app/maestro/:
- flows/land-in-chat.yaml — clearState + direct connect to
  127.0.0.1:6767, lands in the composer. Compose on this for any
  composer-level fixture.
- image-picker-repro.yaml — regression for the zombie-backdrop bug.

docs/MOBILE_TESTING.md gains the patterns: reach-the-composer via
land-in-chat, uncontrolled inputs for Maestro-typed fields, and the
dropdown → native-presenter dismissal timing on iOS.

Existing relay-pairing and relay-then-direct fixtures updated to use
stable testIDs instead of ambiguous text / point-based taps.

packages/app/maestro/flows/land-in-chat.yaml

@@ -0,0 +1,40 @@
+# NOTE: Maestro requires a config section for every flow file, even when used
+# via `runFlow`. Keep this aligned with the dev build application id.
+appId: sh.paseo
+---
+- launchApp:
+    clearState: true
+- runFlow: launch.yaml
+
+- extendedWaitUntil:
+    visible:
+      id: "welcome-screen"
+    timeout: 30000
+
+- tapOn:
+    id: "welcome-direct-connection"
+
+- extendedWaitUntil:
+    visible:
+      id: "add-host-modal"
+    timeout: 10000
+
+- tapOn:
+    id: "direct-host-input"
+- eraseText
+- inputText: "127.0.0.1:6767"
+
+- assertVisible:
+    id: "direct-host-input"
+    text: "127.0.0.1:6767"
+
+- tapOn:
+    id: "direct-host-submit"
+
+- extendedWaitUntil:
+    visible:
+      id: "message-input-root"
+    timeout: 60000
+
+- assertVisible:
+    id: "message-input-attach-button"