feat(07-01): re-resolve safe-area insets on safeAreaChanged / contentSafeAreaChanged

- new watchSafeAreaChanges(wa): registers handlers for both Telegram inset events, each re-applying through the SAME union authority (resolveSafeInsets -> applySafeArea) — never a duplicated computation
- each handler wrapped in try/catch so a throwing client event cannot break the boot (T-07-06b)
- resolveSafeInsets/applySafeArea behaviour unchanged; nothing written to storage

web/src/telegram/safe-area.ts

@@ -56,3 +56,28 @@ export function applySafeArea(insets: SafeInsets): void {
   root.setProperty("--safe-left", `${insets.left}px`);
   root.setProperty("--safe-right", `${insets.right}px`);
 }
+
+/*
+ * PX-04/D-03: the insets above are computed ONCE at boot — but a device
+ * rotation or a fullscreen transition can alter them mid-session
+ * (RESEARCH Pitfall 3), leaving the cockpit under a notch or a Telegram
+ * control. watchSafeAreaChanges re-resolves through the SAME union
+ * authority on the client's inset events — never a duplicated computation.
+ */
+export function watchSafeAreaChanges(wa: TelegramWebAppLike | null): void {
+  if (wa === null || typeof wa.onEvent !== "function") return;
+  wa.onEvent("safeAreaChanged", () => {
+    try {
+      applySafeArea(resolveSafeInsets(wa));
+    } catch {
+      /* a throwing inset event must never break the boot (T-07-06b) */
+    }
+  });
+  wa.onEvent("contentSafeAreaChanged", () => {
+    try {
+      applySafeArea(resolveSafeInsets(wa));
+    } catch {
+      /* a throwing inset event must never break the boot (T-07-06b) */
+    }
+  });
+}