Fix what the gpui-kit stack's review found

An adversarial review of the gpui-kit changes found several problems, now fixed:

• Pressing Enter on a permission card’s focused Deny button allowed the request. It now denies.
• Tab and Shift-Tab escaped open modals. Focus now stays inside.
• A backwards date range in an extension frame crashed the iOS app. The mobile decoder now refuses frames that break the protocol’s cross-field rules.
• The number field sent out-of-range values while typing, and charts of large flat values divided by zero.
• Smaller fixes cover the time field’s seconds, long tree ids, table focus, and a repository filter that hid “Load more”.

cargo deny check also failed on the new dependencies. deny.toml now matches the locked graph, and docs/decisions/2026-11-01-gpui-kit-dependencies.md records the dependency review. The app ships the Lucide icon notice.