refactor(ui): draw the last two overflow menus from the shared menu parts

[kipavy]

Follow-up to #203 and #205, and the end of the sweep. These two were the menus
that did not merely position themselves by hand — they painted their own rows
too, on the wrong tokens: a --t-bg-modal surface with a --t-border divider
and --t-bg-elevated hover, where every other menu uses surface-float with
--t-bg-card-hover, and py-1.5 rows with 12px icons against the shared 16px.

terminal/SnippetsPanel renders MenuItemList inside a PickerSurface. That
turns the two-step "move to folder / back" flow into a real submenu and deletes
the movingToFolder state along with the entire second menu — the file loses 118
lines and gains 43.

mobile/MobileTerminalTopBar renders DropdownMenuItem rows, and picks up an
outside-tap dismiss it never had: until now only tapping an item closed it.

The one non-obvious bit

Hosting MenuItemList inside PickerSurface needed the submenu to be legible to
the surface that opened it. A submenu portals to the body, so it is not a DOM
descendant of that surface, and dismiss-on-outside-mousedown would unmount the row
before its click fired — the exact bug ContextMenu's backdrop comment already
warns about. So the portal is marked data-menu-portal, PickerSurface skips
mousedowns inside one, and the portal moves to z-10000 because a submenu that
flips left overlaps its parent. In the narrow right-hand panel that flip is the
normal case, not the edge case.

ContextMenu and PanelActionsMenu keep their own backdrop-based surfaces for
that same reason — swapping them for PickerSurface would reintroduce the bug.

Verification

tsc --noEmit clean; 205 tests across terminal, shared, mobile and
connections pass.

Driven in the headless build against a real snippet and a real folder:

• the row menu opens as a surface-float card with 16px icons, a divider and a
  red Delete;
• hovering "Move to folder" opens the submenu, which flips left over the parent
  and draws above it;
• clicking Ops in that submenu moves the snippet and closes both menus — the
  dismissal hazard above, confirmed handled rather than assumed;
• Duplicate and Delete apply; an outside mousedown dismisses.

MobileTerminalTopBar is not live-verified: the mobile shell only mounts when
the backend reports android, so it is unreachable from the desktop build. It is
typechecked and covered by the suite; a run on the emulator would need
iterating-on-voltius-android-emulator.