Reorder tabs by dragging, and pop the browser view into its own window

Two things the UI couldn't do: rearrange the tab strip, and watch the
browser while working somewhere else.

**Drag to reorder.** `moveTab`/`moveActiveTab` on the store, HTML5 drag on
the strip with a marker showing where the drop lands, `Ctrl+Shift+←/→` for
the same thing without a mouse. Reordering deliberately does not select
what it moves, so a drag aimed at a background tab doesn't yank the main
area away from a terminal mid-run. A tab being renamed is not draggable —
a draggable ancestor swallows the mouse-drag that selects text in its
input.

**Pop the browser view out.** `browser_view/popout.rs` opens the view's
existing token-bearing loopback URL as a second OS window, with a
"Keep on top" toggle so it can float above the app. Window-only: the
viewer, the proxy and the container are untouched, so popping out and
back interrupts nothing.

Three things it rests on:

- No capability lists that window, so it has no IPC surface — right for a
  page served out of a container, and it must stay that way.
- The app CSP is irrelevant to it: `frame-src` constrains what the app's
  document may *embed*, and this is a top-level document. The port range
  and the token gate are what actually protect it, unchanged.
- The window is owned by the session, so the supervisor's teardown closes
  it. A window onto a viewer that no longer exists is worse than none.

The pane drops its iframe while popped out — two viewers can both *drive*
the browser, and two cursors on one page is not a feature.

`lib.rs`'s `on_window_event` is now guarded on `label() == "main"`. It
fires for every window and its body stops every container and exits, so
without the guard closing a pop-out would quit the app.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/src/lib/tauri-commands.ts

@@ -201,6 +201,25 @@ export const installBrowserViewBrowser = (
   browser: BrowserInstallTarget,
 ) => invoke<BrowserSetupOutcome>("install_browser_view_browser", { projectId, browser });
 
+/**
+ * Detach the live view into its own OS window, or raise it if already open.
+ *
+ * Window-only: the viewer, the proxy and the container are untouched, so
+ * popping out and back costs nothing. The window loads the same token-bearing
+ * loopback URL as the pane, and has no IPC access.
+ */
+export const openBrowserViewPopout = (projectId: string, alwaysOnTop: boolean) =>
+  invoke<void>("open_browser_view_popout", { projectId, alwaysOnTop });
+/** Close the pop-out and put the view back in the tab. No-op if it isn't open. */
+export const closeBrowserViewPopout = (projectId: string) =>
+  invoke<void>("close_browser_view_popout", { projectId });
+/** Asked on tab open: the window outlives the pane, so its state has to be read back. */
+export const isBrowserViewPopoutOpen = (projectId: string) =>
+  invoke<boolean>("is_browser_view_popout_open", { projectId });
+/** Pin the pop-out above other windows — the point of popping it out at all. */
+export const setBrowserViewPopoutAlwaysOnTop = (projectId: string, onTop: boolean) =>
+  invoke<void>("set_browser_view_popout_always_on_top", { projectId, onTop });
+
 // Shared Claude Code auth token — one `claude setup-token` run authenticates
 // every Anthropic-backend project. The token itself is never exposed here: it
 // lives in the OS keychain and is injected as a container env var.