fix: isolate VGUI browser input ownership

[Hona]

Summary

• ignore document keyboard, text-input, and IME events whose target is outside the owning VGUI host
• require input events to target the exact panel DOM node instead of trusting a reusable numeric panel ID
• preserve native Space and Backspace editing in the independent developer-console input
• track and document the browser-event ownership contract

Verification

• bun test (311 pass)
• bun test packages/presentation/vgui/tests (77 pass)
• bun test apps/web/tf2/tests (23 pass)
• bun run --cwd apps/web/tf2 build

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.