tui: fix cursor desync by scanning rendered buffer

Instead of simulating ratatui's word wrapping algorithm, scan the
rendered buffer to find the actual cursor position. This correctly
handles word wrapping, unicode widths, and any other rendering
nuances that ratatui applies.

The old code computed wrapped_height() and cursor position based on
simple character counting, which diverged from ratatui's WordWrapper
that respects word boundaries.

Now we render first, then walk the buffer counting visible characters
until we reach self.cursor. This is O(area) but the input area is
small (typically < 200 cells), so it's negligible.

poc-memory/Cargo.toml

@@ -25,7 +25,7 @@ poc-agent = { path = "../poc-agent" }
 tokio = { version = "1", features = ["rt-multi-thread"] }
 redb = "2"
 log = "0.4"
-ratatui = "0.29"
+ratatui = "0.30"
 skillratings = "0.28"
 crossterm = { version = "0.28", features = ["event-stream"] }