fix(ui): make card actions accessible on touch and keyboard

[ichwars]

Summary

Closes #145.

• Gate secondary-action hiding on a precise hover-capable pointer, not viewport width; reveal keyboard focus across all seven affected owners.
• Reuse FloatingLayer for portalled file/folder/project ActionMenu controls: viewport sizing, first/last focus, arrows/Home/End, Escape/Tab return, outside dismissal and internal scrolling. FolderActions is shared by the tree and the compact selector.
• Archive plate metadata now loads on touch/keyboard intent; coordinate ContextMenu focuses only after becoming visible and restores the opener.
• Preserve PrintOps file classification, permission/ownership checks, commerce domains and existing card layouts. No upstream/static bulk import.
• Audit follow-up: transitive dev-only nanoid 3.3.16 → 3.3.18 (GHSA-2v37-7h3g-55p8). The lockfile changes only this package; npm audit now reports zero.

Issue and scope review

Fresh GitHub review: #145 remains applicable; this PR closes only #145. #126/#150 retain their hardware-validation boundary. Other open issues are not claimed solved.
Selected upstream references: 90fac7b and a72f49b, adapted to PrintOps owners rather than cherry-picked wholesale.

Documentation

Permanent in-repo guide: docs/touch-and-keyboard-controls.md, linked from docs index; CHANGELOG updated.
The CONTRIBUTING-linked separate wiki repository was unavailable in the preceding docs check (404), so the matching documentation is included here. No marketing/version changes.

Verification on 2efb79b

• Full frontend V8 coverage: 3078 tests / 273 files passed; statements 50.42%, branches 46.84%, functions 42.17%, lines 51.45%.
• ESLint, tsc/build, all 11 locale-parity checks passed.
• Production syntax scan: 254 JS/MJS files, Safari 16 baseline.
• 7 production Chromium 149 browser cases passed: project/archive/tag actions without hover; file/folder touch at 390×844 and 1024×844; desktop hover + Tab/Enter/arrows/Escape; short 390×320 and actual internally scrolling 390×200 menus; rename handoff; drag/drop upload.
• Production README collapse/expand smoke passed on desktop/mobile, no relevant console errors.
• Supplementary WebKit 16.0 menu position/focus stability checks: 8 repetitions × 3 viewports = 24 passed at 390×200, 1024×844 and 1440×1000. This repetition exposed a delayed focus-scroll notification race, fixed in 2efb79b: shared outsideScroll helper compares actual offsets since opening, ignores unchanged queued events but still dismisses on new outside movement. Covered by unit and production regressions; no timer/cooldown workaround.
• Permission/ownership, STEP/STP-vs-STL and submenu keyboard regressions covered.
• Repository budget: 1787 files; dependency boundaries/domain guard passed; 22 guard unit tests passed.
• npm audit: 0 vulnerabilities. Bounded subprocess regression confirms nanoid customAlphabet/customRandom size 0 return without hanging.
• Screenshots reviewed locally; temporary builds/evidence remain outside committed source. Existing user static changes were preserved (index hash unchanged).

Integration safety

All work performed inline, without subagents or new worktrees. Only 26 task-owned paths committed; no static files staged.
FileManager and Archives size allowances were tightened after removing obsolete logic. Existing coordinate ContextMenu remains the separate owner for coordinate/submenu interactions; ActionMenu handles flat anchored controls.
Initial automated review of 1333333 completed without findings; the six-path scroll follow-up was reviewed inline. All 24 GitHub jobs passed on the final head: CI (17), CodeQL (3), Security Audit (4). CI independently confirmed 3078 frontend tests, 7 production Chromium cases, both README smoke viewports and the 254-file Safari-16 syntax scan. Backend tests: 8710 passed across host shards, 8694 across Docker shards; final production-container integration: 2950 passed, 171 skipped, 4 warnings (820.37s). No unresolved review threads. Merge authorized only for this exact tested head. Physical devices and assistive-technology combinations beyond the browser simulations are not claimed tested.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T14:13:57.077742Z	1333333	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ichwars]

WebKit-Fokus-/Scroll-Rennfall in 2efb79b behoben: Die zusätzliche Wiederholungsprüfung zeigte, dass ein erst nach dem Menüöffnen zugestelltes Scroll-Ereignis unverändert scrollY=672 und dieselbe Ankerposition meldete. Der gemeinsame Outside-Scroll-Owner ignoriert solche alten Meldungen anhand realer Positionen; echte Außenbewegung schließt weiterhin. Kein Timer-/Cooldown-Workaround.

Lokale Verifikation: 3078/3078 Tests in 273 Dateien mit Coverage, ESLint, TypeScript/Produktionsbuild, 254 JS/MJS-Dateien mit Safari-16-Syntaxbaseline, 7 Chromium-Produktionsfälle, 24 WebKit-Stabilitätsprüfungen und README-Smoke auf zwei Viewports. Source-Budget für 1787 Dateien und Dependency-Boundaries bestanden. npm audit: 0. Regressionen committed; Folgepatch inline geprüft, keine Sub-Agenten.

GitHub auf genau diesem Head bestätigt inzwischen dieselben 3078 Frontend-Tests, alle 7 Chromium-Produktionsfälle, beide README-Smokes und den Safari-16-Syntaxcheck. CodeQL, Security-Audits und PostgreSQL-Prüfung sind ebenfalls grün. Der abschließende Produktionscontainer-Lauf steht noch aus; Merge erst nach vollständig grüner CI.

Nutzeränderungen unter static/ sind unverändert und nicht Bestandteil des PR.