What Problem This Solves

#100258 fixed the omitted TLS-port default from #99887, but repeated live gateway setup links exposed a separate delivery race: any mounted SettingsProTab could consume the app-global one-shot request, including a hidden embedded settings surface. The visible canonical Settings screen could then miss the link entirely.

Why This Change Was Made

• Make RootTabs the single owner of gateway setup link consumption and routing.
• Pass a typed, identity-bearing request only to the canonical phone/iPad Settings destination.
• Clear the request only after that destination acknowledges staging it, preventing both hidden-view consumption and replay.
• Centralize the TLS/plaintext default-port mapping and cover omitted/explicit ports in focused tests.
• Remove the now-unused terminal web-content identity overload so the iOS dead-code gate remains green.

User Impact

Repeated openclaw://gateway/setup links now reliably populate the visible gateway settings on both phone and iPad. TLS links without an explicit port use 443, plaintext links use 18789, explicit ports remain unchanged, and an already-applied link is not replayed.

Evidence

• swift test --package-path apps/shared/OpenClawKit --filter DeepLinksSecurityTests — 21/21 passed.
• node --import tsx scripts/native-app-i18n.ts check — 2,493 entries, no changes required.
• xcodebuild -project apps/ios/OpenClaw.xcodeproj -scheme OpenClaw -configuration Debug -destination 'id=E617A5DF-735E-442C-98EC-31C140517359' -derivedDataPath /tmp/pr99887-final-derived build — succeeded.
• Live exact-app simulator proof: two consecutive unique TLS links applied through the real Connect flow on iPhone and iPad; the second host replaced the first, port was 443, and TLS remained enabled.
• Fresh branch autoreview: no findings; patch correct, confidence 0.84.
• git diff --check origin/main...HEAD — clean.

No visual layout or styling changed, so before/after screenshots would not add useful UI evidence.

Follow-up to #99887 and #100258.