Add wrapping keyboard and gamepad focus rings

- Link every modal's enabled controls into a wrapping UiFocus ring and give each screen a default focus target.
- Add gamepad A/B bindings for ui_accept/ui_cancel; include Start menu footer actions and Continue in its focus ring.
- Skip hidden/disabled controls, close focus traps via per-modal cancel behavior, and return review to the menu on cancel.
- Record the focus audit and add regression coverage.

MEMORY.md

@@ -61,6 +61,12 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   gallery is 13 good / 0 bad, the screen-design judge is 13/13 and a clean
   portrait measured a 0.732 vision gap against the photoreal concept. No
   release build, version bump or tag was created at this gate.
+- **UI focus (2026-11-02):** `src/game/ui/ui_focus.gd` links visible/enabled
+  controls into a wrapping ring; each modal sets default focus on open. Start menu
+  uses its own focus-target list so Continue, venue rows and footer actions share
+  one ring. `GuardController._ensure_gamepad_bindings()` adds A/B to
+  `ui_accept`/`ui_cancel` so pad-only users can confirm/cancel; hidden Continue and
+  disabled timeline buttons never enter the ring.
 - **Button states (2026-11-02):** `src/game/ui/ui_styles.gd` owns the five action-button
   states and font colours for the dark session/UI shell. Use `UiStyles.apply_button()`
   for every new `Button`; CheckButton/OptionButton keep the engine theme. Timeline
@@ -706,7 +712,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Venue `door_staff_lines` are logged through `GameManager` (inspect / wand / refuse). They are not a separate dialogue UI.
 - Access loadout is implemented; do not re-fix `override_access` as if it were still unread.
 - `Save.SETTINGS_FILE` is declared and unused; settings persistence goes through `Save.load_settings()` / `save_settings()`.
-- Headless suite is **259/259**; the windowed smokes, screenshot compare and judge pass. Remaining visual follow-ups are in `TODO.md`.
+- Headless suite is **260/260**; the windowed smokes, screenshot compare and judge pass. Remaining visual follow-ups are in `TODO.md`.
 - Typed spawn signal extra args: handlers must accept the 4th `event: Dictionary` or Godot will not call them (`test_shift_coordinator_runs_a_shift` failed until `_on_spawn` took four args).
 - GDScript inference trap that broke the main scene: a `var` typed as a base class
   (`radial: CanvasLayer`) exposes script members as `Variant`, so `var x := radial.is_open` is a