Refuse a repeated undo of a withdrawn reaction instead of faulting on it

[leaf-agent]

undo_error raised StopIteration out of POST /api/event when the undo named a reaction that had already been taken back. The withdrawn check sat below the per-kind ones, and the reaction branch walks build_threads for the thread holding the target — a fold that drops withdrawn events, so the walk had nothing to find and next() had no default. The fix moves the withdrawn check above the kind dispatch: whether a gesture still stands is a fact about the target, not about its kind, and every question below it reasons about a gesture that does.

This is the racing-tabs case the function's own docstring names — "the second is a no-op, and refusing it costs a toast". For a resolve or an action it does cost a toast. For a reaction it cost a 500 {"error": "StopIteration: "}, and _answer in http.py deliberately marks an unexpected fault retryable rather than final — so the browser retried the same attempt against a state that will never answer differently, wedging the gesture in the outbox instead of putting it back.

The other caller is unaffected: _browser_undo_candidates skips event["id"] in withdrawn before asking, so it never reached the raise and never reaches the new early return.

Verification

The regression test extends test_the_door_admits_a_reaction_only_as_a_token_the_layer_declares, which already presses undo on a reply reaction once and expects 200. It now presses a second time and expects the final 400. Against the unpatched events.py it reproduces the fault through the real HTTP door:

>       assert status == 400, body
E       AssertionError: b'{"error": "StopIteration: "}'
E       assert 500 == 400

Every other refusal message is unchanged — a spoken comment is still "is not a reaction", an undo is still "undo events cannot be taken back", and a repeated undo of a resolve still reads "already been taken back". None of the kinds routed around the moved check can be in taken_back in the first place: the door refuses their withdrawal, so nothing can have withdrawn them.

Ran locally: tests/test_interact_contract.py (217 passed), plus test_interact_server.py, test_interact_document.py, test_interact_session.py, test_interact_product.py (313 passed). The browser suites did not run — this sandbox has no Playwright browsers installed — so CI is their first pass. The change is Python-only and the browser-facing caller pre-filters, so no browser behaviour moves.