fix: prevent mouse packets leaking into remote shells

[moneycaringcoder]

Summary

• consume ordinary SGR mouse packets before remote input and predictive echo, including packets split across terminal reads
• keep wheel input on semantic terminal.scroll, including Shift/Alt/Ctrl modifiers and source ordering with keyboard input
• add global and per-host mouse_click_passthrough configuration for mouse-aware remote TUIs
• bound incomplete mouse parsing so malformed input is eventually forwarded byte-for-byte instead of being retained indefinitely
• document the default and the terminal-session API limitation

Fixes #2

Behavior

mouse_click_passthrough defaults to false, preventing clicks, releases, drags, and motion from becoming shell input. Set it globally or under [hosts.<name>] to restore raw non-wheel mouse forwarding for a host running mouse-aware TUIs. Wheel scrolling remains semantic in either mode.

Why configuration

An earlier implementation inferred remote mouse mode by scanning frames, but upstream intentionally left that gate out in 34ba4f6. Terminal frames are normalized and may not contain the remote application's original DECSET/DECRST sequence, so this change avoids reviving that heuristic. Explicit passthrough keeps the behavior deterministic until Herdr exposes mouse mode through the terminal-session API.

Test plan

• cargo test — 41 passed
• cargo clippy --all-targets — passed with the same four warnings present on upstream main
• cargo build --release
• manual reproduction and verification with Herdr v0.7.3 on macOS in Ghostty