fix(ui): retail target-cursor shape (pending over UI, world-object driven) + visible UseDone refusals

Visual gate round 2 (user, retail oracle): the target cursor over UI must
be the 0x27 four-arrows PENDING cursor — retail's UpdateCursorState
(0x00564630) keys valid/invalid solely off the SmartBox found object,
i.e. the WORLD entity under the cursor. And "can't heal myself" turned
out to be TWO stacked causes, both fixed:

- Cursor: UI hover no longer forces TargetInvalid (that arm was a
  non-retail invention) and the doll/status-bar hover providers are
  gone (UiElement.UseTargetGuidProvider deleted). Valid/invalid now
  come from (a) a hovered occupied item slot's own item, or (b) the
  world entity under the cursor via a new worldTargetProvider — the
  B.4b screen-rect picker extracted into GameWindow.PickWorldGuidAtCursor
  and shared by click + hover.
- Self-heal: the world picker always skipped the local player
  (skipServerGuid), so clicking your own toon in target mode could
  never acquire self. Target-use picks now include self (retail lets
  you kit-heal yourself by clicking your character); plain selection
  keeps the exclusion. The doll click still self-targets.
- Silent refusals: the [use-target] log proved the UseWithTarget action
  WAS sent (kit 0x00220008 / TargetType 0x10, target self) — ACE
  refused with WeenieError.YouArentTrainedInHealing (0x04FC) and we
  never parsed UseDone (0x01C7). Now dispatched + surfaced as a chat
  line via WeenieErrorText (interim subset map, register AP-74, #166
  ports the retail String-table lookup).

Full suite green (3,295).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/UI/CursorFeedbackController.cs

@@ -42,10 +42,14 @@ public readonly record struct CursorFeedbackSnapshot(
 public sealed class CursorFeedbackController
 {
     private readonly ItemInteractionController? _itemInteraction;
+    private readonly Func<uint>? _worldTargetProvider;
 
-    public CursorFeedbackController(ItemInteractionController? itemInteraction = null)
+    public CursorFeedbackController(
+        ItemInteractionController? itemInteraction = null,
+        Func<uint>? worldTargetProvider = null)
     {
         _itemInteraction = itemInteraction;
+        _worldTargetProvider = worldTargetProvider;
     }
 
     public CursorFeedback Current { get; private set; } = CursorFeedback.Default;
@@ -55,6 +59,20 @@ public sealed class CursorFeedbackController
         ArgumentNullException.ThrowIfNull(root);
 
         UiElement? hover = root.Pick(root.MouseX, root.MouseY);
+
+        // Retail UpdateCursorState (0x00564630) keys the target-mode cursor off
+        // the SmartBox found object — the WORLD entity under the cursor. A UI
+        // window occludes the world (no found object → pending). The one
+        // UI-side source retail-style cells contribute is an occupied item
+        // slot's own item.
+        uint hoverTarget = 0;
+        if (_itemInteraction?.IsTargetModeActive == true)
+        {
+            hoverTarget = hover is not null
+                ? FindHoveredItemSlot(hover)?.ItemId ?? 0u
+                : _worldTargetProvider?.Invoke() ?? 0u;
+        }
+
         var snapshot = new CursorFeedbackSnapshot(
             DragPayload: root.DragPayload,
             DragAccept: FindHoveredItemSlot(hover)?.DragAcceptVisual ?? UiItemSlot.DragAcceptState.None,
@@ -64,7 +82,7 @@ public sealed class CursorFeedbackController
             HoverWindowMove: root.HoverWindowMove,
             HoverUi: hover is not null,
             HoverTextEdit: hover?.IsEditControl == true,
-            HoverTargetGuid: ResolveUseTargetGuid(hover));
+            HoverTargetGuid: hoverTarget);
 
         var kind = ResolveKind(snapshot);
         Current = new CursorFeedback(kind, ResolveCursor(root.Captured, hover, kind));
@@ -110,9 +128,12 @@ public sealed class CursorFeedbackController
                         : CursorFeedbackKind.TargetInvalid;
             }
 
-            return snapshot.HoverUi
-                ? CursorFeedbackKind.TargetInvalid
-                : CursorFeedbackKind.TargetPending;
+            // Retail UpdateCursorState (0x00564630), TARGET_MODE 3: no found
+            // object → the 0x27 four-arrows pending cursor — INCLUDING over
+            // UI chrome. Valid/invalid exist only with a target under the
+            // cursor. (The earlier HoverUi → Invalid arm was a non-retail
+            // invention — 2026-07-03 visual gate.)
+            return CursorFeedbackKind.TargetPending;
         }
 
         if (snapshot.HoverWindowMove)
@@ -236,20 +257,4 @@ public sealed class CursorFeedbackController
         }
         return null;
     }
-
-    private static uint ResolveUseTargetGuid(UiElement? element)
-    {
-        while (element is not null)
-        {
-            uint provided = element.UseTargetGuidProvider?.Invoke() ?? 0u;
-            if (provided != 0)
-                return provided;
-
-            if (element is UiItemSlot { ItemId: not 0 } slot)
-                return slot.ItemId;
-
-            element = element.Parent;
-        }
-        return 0u;
-    }
 }