feat(web): a click is resolved in Rust, and the sidebar obeys its flag

The user's rulings on the two beads PR #55 filed.

improvise-7ybz: the browser was keyboard-only by omission. Nothing outside an
editable grid cell had a click listener, so clicking the collapse triangle on a
category did nothing — which is what "I can't expand categories" meant, since
the keyboard path worked all along.

`improvise_protocol::resolve::click` now answers all three widgets under one
rule: **go there, then do what Enter does there.** A category row focuses the
panel, moves its cursor and activates (expand on a header, filter on an item);
a tile selects and cycles its axis; a cell moves the selection, with the page's
inline editor as the pointer's `i`. One rule rather than three inventions, and
it is the keyboard's own definition rather than a second one — `cat_tree_entry`,
`toggle_cat_expand`, `filter_to_item` and `tile_axis` each gained an `_at` twin
and the cursor-reading form is now a one-line call of it.

It lives in the protocol crate, not the wasm client, for the `flatten_cat_tree`
reason: a third front end must call this, not derive it. `Client::click_category`
/ `click_tile` / `click_cell` are thin wasm-bindgen wrappers that fold and
serialize exactly as `key` does, so `app.js` still composes no `Command`.

The subtlety worth knowing: a click's three intents are resolved in one pure
call, so the activation must be asked about the row *clicked*, never about
`cat_panel_cursor` — the `SetPanelCursor` ahead of it has not been folded yet.
Injecting that exact fault turns `ToggleCatExpand("Product")` into
`ToggleCatExpand("Region")`, which is the silent half and is now pinned.

improvise-wsaw: `RenderModel::category_panel_open` existed from the start and
`app.js` never read it, so the sidebar was drawn unconditionally and `C` moved
only the mode label. It now hides on load and toggles with `C`, matching
`src/draw.rs:322` and the two panels PR #55 added. A first-time visitor sees
one fewer thing; the user chose front-end consistency, and the grid is still
populated.

Tests: harness/tests/pointer.spec.js, six assertions, **all six proved by
running them against the bundle built immediately before this commit** — where
the sidebar is wrongly visible and every click lands on an element with no
listener. Plus four Rust tests on the resolver, one of them proved by the
injection above.

Note this branch is based on gh/main but MERGES fix/web-ui-correctness (PR #55):
click_tile needs a tile bar to click, and that is #55's. Rebase or re-merge once
#55 lands.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/app.js

@@ -189,6 +189,9 @@ function repaint() {
   paintStatus();
   el.viewName.textContent = model.view_name;
   el.grid.replaceChildren(gridTable(model));
+  // The flag is the client's answer, not the page's: `C` toggles it and the
+  // TUI draws the panel on exactly the same condition (improvise-wsaw).
+  el.categories.hidden = !model.category_panel_open;
   el.categories.replaceChildren(categoryList(model));
   paintTiles(model);
   paintPanel(el.views, model.views, viewRow);
@@ -326,8 +329,15 @@ function gridTable(model) {
       // `editable` is the server's answer relayed through Rust: a stored cell.
       // Drill is not on the wire yet, so an aggregate is not offered.
       td.classList.toggle("editable", cell.editable);
-      if (cell.editable)
-        td.addEventListener("click", () => edit(td, dataRow, c, cell.edit_text));
+      // Every cell moves the selection; an editable one also opens its editor,
+      // which is the pointer's `i`. Not repainted in that branch: `edit` has
+      // set `editing`, and a repaint would take the <input> away.
+      td.addEventListener("click", () => {
+        const frame = client.click_cell(dataRow, c);
+        if (frame) transport.send(frame);
+        if (cell.editable) edit(td, dataRow, c, cell.edit_text);
+        else repaint();
+      });
     });
   }
   return table;
@@ -420,11 +430,12 @@ function formulaRow(row) {
  *  decided in Rust; an empty tile list draws nothing at all. */
 function paintTiles(model) {
   el.tiles.hidden = model.tiles.length === 0;
-  const tiles = model.tiles.map((tile) => {
+  const tiles = model.tiles.map((tile, index) => {
     const span = document.createElement("span");
     span.className = "tile";
     span.classList.toggle("selected", tile.selected);
     span.textContent = `${tile.category} ${tile.axis}`;
+    span.addEventListener("click", () => send(client.click_tile(index)));
     return span;
   });
   el.tiles.replaceChildren(...tiles);
@@ -432,18 +443,26 @@ function paintTiles(model) {
 
 function categoryList(model) {
   const list = document.createElement("ul");
-  for (const row of model.categories) {
+  model.categories.forEach((row, index) => {
     const li = document.createElement("li");
     li.className = row.is_category ? "category" : "item";
     li.classList.toggle("selected", row.selected);
     li.textContent = row.is_category
       ? `${row.expanded ? "▾" : "▸"} ${row.label} (${row.item_count}) ${row.axis}`
       : row.label;
+    li.addEventListener("click", () => send(client.click_category(index)));
     list.appendChild(li);
-  }
+  });
   return list;
 }
 
+/** Send what a `click_*` call returned, and repaint. `null` means the click
+ *  resolved to nothing, which is an answer and not a failure. */
+function send(frame) {
+  if (frame) transport.send(frame);
+  repaint();
+}
+
 // The keyboard. `Client::on_key_event` folds locally where it can; what it
 // cannot answer is sent and does nothing, by design (context/code/clients.md).