feat(chat): CT-B2 — "/r " expands to a tell at whoever last told you

Campaign CT slice B2, and the autocomplete the user asked about directly.

Typing "/r " now rewrites the chat entry to "@tell {LastTeller}, " the moment
the space lands, matching ChatInterface::HandleTextReplacements @0x004F50D0 ->
SetReplyTextInChatBox @0x004F4760.

This is display sugar rather than routing: "/r hello" already SENT correctly
through ChatInputParser's reply aliases. What was missing is that the player
could not SEE who they were about to reply to before pressing enter.

The trigger strings came out of the constant pool, not the decompiled listing —
Binary Ninja renders them as bare data_* references with no preview:

    data_7C4C70 = "r "      data_7C4C68 = "rp "      data_7C4C58 = "reply "

Retail stores them WITHOUT the leading prefix and tests the first character
separately against '/' (0x2F) or '@' (0x40), which is why both prefixes work.
The research summary for this area listed the triggers as "/t ", "/tell " and
"reply " — reading the pool corrected that.

Three boundaries, each pinned by test because each is a way to get this subtly
wrong:

  - The trailing space is PART of the trigger. "/r" alone must be left alone —
    the player may still be typing "/roleplay", and expanding early would
    hijack a different command mid-word.
  - Only on space. Running the replacer per keystroke would rewrite text out
    from under someone mid-word; retail keys on 0x20 specifically.
  - Only with the caret at the end. Otherwise the player is editing existing
    text, and expanding would corrupt a sentence they are part way through
    fixing.

With nobody to reply to, nothing is rewritten — retail leaves the text alone
rather than producing a tell addressed to nobody, and the ordinary submit path
still reports "Someone must @tell you first!".

Solution builds clean; full hermetic gate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/AcDream.App.Tests/UI/UiFieldTests.cs

@@ -200,4 +200,62 @@ public class UiFieldTests
         Assert.Equal("a\nb", input.Text);
         Assert.Equal(0, submissions);
     }
+
+    // ── CT-B2: typed-abbreviation expansion ─────────────────────────────
+
+    [Fact]
+    public void TypingASpaceOffersTheTextToTheReplacer()
+    {
+        var input = new UiField();
+        input.TextReplacer = text => text == "/r " ? "@tell Dww, " : null;
+
+        foreach (char c in "/r ")
+            input.InsertChar(c);
+
+        Assert.Equal("@tell Dww, ", input.Text);
+        Assert.Equal("@tell Dww, ".Length, input.CaretPos);
+    }
+
+    [Fact]
+    public void ANonSpaceCharacterNeverTriggersTheReplacer()
+    {
+        // Retail keys the expansion on 0x20 specifically; running it on every
+        // keystroke would rewrite text out from under someone mid-word.
+        int calls = 0;
+        var input = new UiField();
+        input.TextReplacer = _ => { calls++; return null; };
+
+        foreach (char c in "/reply")
+            input.InsertChar(c);
+
+        Assert.Equal(0, calls);
+    }
+
+    [Fact]
+    public void EditingInTheMiddleOfALineIsNotRewritten()
+    {
+        // The caret is not at the end, so the player is editing existing text
+        // rather than typing an abbreviation — expanding here would corrupt a
+        // sentence they are part way through fixing.
+        var input = new UiField();
+        input.SetText("/r hello");
+        input.MoveCaret(-5);                 // caret sits just after "/r"
+        input.TextReplacer = _ => "@tell Dww, ";
+
+        input.InsertChar(' ');
+
+        Assert.Equal("/r  hello", input.Text);
+    }
+
+    [Fact]
+    public void AReplacerReturningNullLeavesTheTextExactlyAsTyped()
+    {
+        var input = new UiField();
+        input.TextReplacer = _ => null;
+
+        foreach (char c in "hi ")
+            input.InsertChar(c);
+
+        Assert.Equal("hi ", input.Text);
+    }
 }