fix(agent): remote-control input now works (data channel + nut-js API)

Two latent bugs that broke input control on any setup:
- Data channel was created by the viewer (the answerer), so the agent's offer had
  no SCTP m-line and the channel never opened -> no input reached the agent. The
  agent (offerer) now creates the 'input' channel; the viewer receives it.
- inject.js used nut.screen.getResolution() which doesn't exist in this nut-js;
  switched to screen.width()/height() with per-session caching.

Verified end-to-end locally: screen streams + mouse injection moves the remote cursor.
Also commits desktop/ + mobile/ package-lock.json from client installs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/input/inject.js

@@ -41,10 +41,17 @@ function mapKey(key, code) {
   return null;
 }
 
+// Cache the screen size (this nut-js exposes screen.width()/height(), not getResolution()).
+// Recomputed once per session (cleared in releaseAll) so a resolution change is picked up.
+let _screen = null;
+async function screenSize() {
+  if (!_screen) _screen = { w: await nut.screen.width(), h: await nut.screen.height() };
+  return _screen;
+}
 async function moveTo(xNorm, yNorm) {
   if (!nut) return;
-  const { width, height } = await nut.screen.getResolution();
-  await nut.mouse.setPosition(new nut.Point(Math.round(xNorm * width), Math.round(yNorm * height)));
+  const { w, h } = await screenSize();
+  await nut.mouse.setPosition(new nut.Point(Math.round(xNorm * w), Math.round(yNorm * h)));
 }
 
 function buttonEnum(b) {
@@ -98,6 +105,7 @@ async function releaseAll() {
   if (!nut) { pressed.clear(); return; }
   for (const k of pressed) { try { await nut.keyboard.releaseKey(k); } catch {} }
   pressed.clear();
+  _screen = null;
 }
 
 module.exports = { inject, releaseAll, available, mapKey };