fix(web): sandbox copy works on HTTP/intranet

[cocofhu]

Summary

• Add reusable copyToClipboard helper: secure context prefers Clipboard API; non-secure (HTTP/intranet) skips API and uses textarea + execCommand('copy') in the same gesture stack; returns Promise<boolean> without throwing.
• Wire SandboxListView (detail proxy URL / ENDPOINTS / copy ID) and SandboxConsoleView (copy password) to the helper: success keeps inline「已复制」; failure shows Toast common.toast.copyFailed（复制失败 / Copy failed）— no silent catch.
• Colocated vitest covers secure success (no fallback), non-secure / API reject → fallback success, and dual failure → false.

Coverage (this PR only): SandboxListView + SandboxConsoleView. Out of scope (unchanged): ArtifactPreview, PmLeaderChat, WorkflowApiTab, AgentStudioView.

Test plan

• npm test -- --run src/lib/copyToClipboard.test.ts (6 cases green)
• Manual: open sandboxes over http://内网IP, click detail「复制」on proxy path and host:port — clipboard gets text, button shows「已复制」
• Manual: HTTPS/localhost — Clipboard API path succeeds without unnecessary fallback
• Force dual failure (if possible) — Toast「复制失败」/「Copy failed」, button does not enter「已复制」
• Console copy password: success inline; failure Toast does not leak password plaintext

Made with Cursor