Fix composer upload races and desktop downloads

[powerfooI]

Summary

• Insert completed uploads using the latest shared draft and caret, so concurrent React-batched completions cannot overwrite an earlier path or unselected trailing text.
• Preserve the insertion point while pending uploads complete in Direct mode, and ignore stale DOM selection events before React commits. Keep current edits, pane/remount routing, and retired-session safeguards.
• Use Roamgate's resolved Mobile/Desktop layout for file delivery. Desktop downloads directly, including standalone web apps and explicit desktop overrides. Existing mobile iOS sharing, cancellation, and browser fallbacks remain unchanged.
• Add isolated real-React/Happy DOM upload regressions and layout-integrated download tests. No version bump or unrelated filename migration changes.

Verification

• GitHub CI passed for head 470cca3aabe52fd72c65a31168cf38cf57b8ba97: formatting, lint, full types/production build, site build, and the complete suite (2,367 passed, 2 skipped, 0 failed).
• Passed bun run build:web, including unchanged asset budgets: initial JS gzip 207,864 / 207,872 bytes (8 bytes spare). A disposable 0.7.14 version simulation also passed; the branch remains 0.7.13.
• Passed bun run build:site.
• Passed all frontend tests: 1,084 passed, 0 failed. New DOM suites run in isolated child runtimes, with 12 upload cases and 10 download cases.
• bun run precommit: formatting, lint, full TypeScript checks, and embedded production web build passed. Aggregate tests: 2,103 passed, 2 skipped, 264 failed. The failing test-name set exactly matches the unmodified-main baseline (2,101 passed, 2 skipped, 264 failed); existing local socket/process environment restrictions remain, including when retried outside the normal sandbox. This is not a complete local precommit pass.
• Independent source review and separate harnesses passed: 14 original interaction cases, 7 additional upload race/event cases, and 11 layout/download cases.

Browser coverage limits

Automated component tests use real React with Happy DOM and mocked upload/delivery APIs. The cloud Chromium attempt to open the local harness was blocked by the browser client, so no actual-browser, native share-sheet, physical iOS/Android, or full-backend acceptance pass is claimed. The unrestricted aggregate suite passed in GitHub CI.