feat(07-01): wire fullscreen + safe-area watch onto the guidance lifecycle edges

- route.ts: requestGuidanceFullscreen at BOTH guidance-start edges (activateGuidance + resume) directly after engageCloseProtection — synchronous, best-effort, return ignored
- route.ts: exitGuidanceFullscreen at BOTH teardown edges (teardownGuidance + stopGuidanceArtifacts) directly after releaseCloseProtection
- route.ts: watchFullscreenEvents registered exactly ONCE at the guidance-start edge; the callback is a deliberate no-op (observability only, D-14)
- main.ts: watchSafeAreaChanges(getWebApp()) called at the boot site directly after applySafeArea(resolveSafeInsets(getWebApp())) — insets re-resolve at runtime, not only once at boot (T-07-06b)
- no new logging; the route module's state-token console law unchanged

web/src/main.ts

@@ -33,7 +33,7 @@ import { createRecenterControl } from "./ui/recenter.ts";
 import { getWebApp } from "./telegram/webapp.ts";
 import { watchTheme } from "./telegram/theme.ts";
 import { wireBackButton } from "./telegram/backbutton.ts";
-import { resolveSafeInsets, applySafeArea } from "./telegram/safe-area.ts";
+import { resolveSafeInsets, applySafeArea, watchSafeAreaChanges } from "./telegram/safe-area.ts";
 import { createSession } from "./session/client.ts";
 import { getSession, isSessionStale } from "./session/store.ts";
 import { acquireFix, isFixStale, fixAgeSeconds } from "./location/chain.ts";
@@ -72,6 +72,11 @@ void boot();
 async function boot(): Promise<void> {
   // 1 — safe-area vars are set before any layout reads them (PX-03 groundwork).
   applySafeArea(resolveSafeInsets(getWebApp()));
+  // PX-04/D-03: the insets re-resolve at RUNTIME too — rotation and fullscreen
+  // transitions re-apply through the same union authority on the client's
+  // inset events. Same one-shot getWebApp() value as the apply line above;
+  // internally guarded (null WebApp / missing onEvent → returns immediately).
+  watchSafeAreaChanges(getWebApp());
 
   // 3 (declared ahead of their first use inside the closures below) — the
   //    single-shell state the BackButton resolver and the stale branch read: