a11y: phone menu inert follow-ups (late DOM, shared inert, 320px toggle) #1110

Remaining P3 findings from the review of #1107 (#1102). None affects today's pages; they are latent or edge cases.

• Late DOM stays live. inertOutside in apps/web/src/lib/focus-trap.ts takes its snapshot when the phone menu opens. Anything added to the page while it is open (a toast, a cookie banner, a portal, new content after a soft navigation that does not remount the page) is not inert. No createPortal exists in src today. A MutationObserver on the kept ancestors, or rendering overlays inside the inert-aware tree, would close this.
• Restore can clear someone else's inert. The undo sets inert = false on every element it touched, even when other code made the same element inert while the menu was open. Nothing else in src uses inert today; a reference count or a data attribute marking our own changes would make it safe.
• At 320px the drawer covers the toggle. The drawer is a 320px fixed panel (z-index 20000, style.scss). At a 320px viewport (supported since fix(web): pages scroll sideways at 320px; the phone menu button is cut off #809) the live toggle sits under it: a screen reader still reaches a visually hidden button, and focus handed back to it is invisible until the drawer slides out. A narrower drawer below 360px, or hiding the toggle from the accessibility tree while the drawer covers it, would fix it.