Fix #1308: copy-SteamID button no longer dead; clipboard delegate honest on plain HTTP

[rumblefrog]

Summary

Fixes #1308 — two bugs in the [data-copy] surface area, both visible identically on every Edge / Chrome / Firefox once the panel is served over plain HTTP behind a TLS-terminating reverse proxy.

Defect A — banlist row's copy button was a dead button

page_bans.tpl carried onclick="event.stopPropagation()" on the <button data-copy=…> row action. The single document-level COPY BUTTONS click delegate in theme.js listens on the bubble phase, so the element-level stop killed every click before the handler ran — no toast, no clipboard write, no console error. Removed the inline stopPropagation; added a stable data-testid="row-action-copy-steam" so the regression spec can target the button without depending on the visible 📋 glyph.

The defensive copy-paste from the sibling Edit/Unban anchors isn't load-bearing for those — they survive on native href navigation regardless. The desktop row's drawer trigger is the player-name anchor (data-drawer-href), not a row-level delegate, so a bubbling click from the copy button has nothing to confuse.

Defect B — drawer / row copy buttons silently lied on plain HTTP

The pre-fix delegate was

if (navigator.clipboard) navigator.clipboard.writeText(value);
showToast({ kind: 'success', title: 'Copied to clipboard' });

On non-secure contexts (the typical self-hoster behind a TLS-terminating reverse proxy where the panel sees plain HTTP) navigator.clipboard is undefined, the writeText is a silent no-op, and the success toast fires anyway — the user sees "Copied" with an empty clipboard. Even on a secure context the Promise can reject and the success toast still fires.

Rewrote the delegate to mirror handlePaletteCopyShortcut (the canonical "do clipboard right" shape already shipped on the palette's Ctrl/Cmd+Enter shortcut):

1. Feature-detect both navigator.clipboard AND window.isSecureContext; either missing → fallback path.
2. .then(success, fallback) on the Promise so a rejected writeText() drops to the same fallback.
3. copyFallback() = hidden-textarea + document.execCommand('copy') — the deprecated-but-shipping API every browser still implements for this exact non-secure-context path. Toast reflects the actual outcome (success vs honest error).

Docs

• AGENTS.md gains a "Where to find what" row for the canonical single-source clipboard wiring + two anti-pattern entries (no inline stopPropagation on [data-copy]; no unconditional success toast on writeText()).
• ARCHITECTURE.md's web/scripts/ row corrects the false claim that banlist.js owns the copy-button wiring.
• banlist.js's own docblock is updated to point readers at the document-level delegate in theme.js.

Test plan

• New regression spec web/tests/e2e/specs/flows/ui/copy-buttons.spec.ts covers all three paths against the live panel:
  • banlist desktop row click writes the SteamID + toasts (Defect A guard);
  • drawer overview SteamID button writes + toasts (delegate-shared regression for the drawer surface);
  • non-secure-context monkey-patch (navigator.clipboard = undefined) drops to the execCommand fallback and still toasts (Defect B guard).
• The spec also asserts the absence of the inline onclick attribute on the row's copy button so the Defect A regression resurfaces if a future dev re-adds the defensive copy-paste.

Quality gates run locally (parallel stack on ports :18308 / :13308 / :19308 / :25308 / :21308):

Gate	Result
./sbpp.sh phpstan	pass (No errors, 228 files)
./sbpp.sh test	pass (403 tests, 1765 assertions; 1 pre-existing PHPUnit deprecation, no failures)
./sbpp.sh ts-check	pass (clean tsc over web/scripts)
./sbpp.sh composer api-contract	clean diff (no API change)
./sbpp.sh e2e --grep "copy buttons"	3 passed, 3 skipped (mobile-chromium gates)
./sbpp.sh e2e --grep "command palette|player drawer|responsive: drawer"	22 passed, 16 skipped — no regression in adjacent specs