feat(ui): add DataTable and Toaster, drop the legacy Table, fix overlay dialogs

DataTable replaces the 20-line Table scaffold entirely: columns, sorting,
filtering, pagination, selection, bulk actions, comparison layout, sticky
first column, custom HTML cells, and a remote source driven by a `request`
output rather than a function prop (props travel as HTML attributes, so a
function arrives as its own source text).

Toaster replaces the hand-rolled status div: tone icons, actions, hover
pause/resume and a progress bar.

Overlays audit -- Modal and Drawer declared aria-modal="true" but nothing
ever moved focus into the panel, so the @keydown handler on their root
never ran and closeOnEscape did nothing. Focus, focus restore, a Tab trap
and a body scroll lock now live in the reactive runtime, shared by both.

ContextMenu placed pointer menus by subtracting a guessed 340x420 from the
viewport, which pushed every menu that was not that size away from the
pointer; it now positions at the pointer and lets the anchored clamp pull
it back once it can be measured.

The reactive runtime size budget moves 150k -> 175k to cover anchored
overlays, dialog behaviour, the toaster and the DataTable client half.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/cli/src/build.ts

@@ -47,7 +47,7 @@ import {
   renderThemeCss,
   renderThemeRuntime,
 } from "@wrnexus/styles";
-import { uiComponentsDir, uiCss } from "@wrnexus/ui";
+import { uiComponentsDir, uiCss } from "@wrnexus/ui/registry";
 import { renderSchemasScript, type ObjectSchema, type SchemaDescriptor } from "@wrnexus/validation";
 import { loadLocales, resolveI18n } from "@wrnexus/i18n";
 import { pathToFileURL } from "node:url";

packages/cli/src/eject.ts

@@ -6,7 +6,7 @@
 
 import { copyFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { uiComponentNames, uiComponentPath } from "@wrnexus/ui";
+import { uiComponentNames, uiComponentPath } from "@wrnexus/ui/registry";
 
 export function runEject(appRoot: string, names: string[]): void {
   const root = resolve(appRoot);

packages/cli/src/inspect.ts

@@ -3,7 +3,7 @@ import { dirname, join, relative, resolve } from "node:path";
 import { buildRouter, createRouteManifest, nameRoutes } from "@wrnexus/router";
 import { createPluginRunner, discoverPlugins } from "@wrnexus/plugin";
 import { loadAppConfig } from "@wrnexus/styles";
-import { uiComponentsDir } from "@wrnexus/ui";
+import { uiComponentsDir } from "@wrnexus/ui/registry";
 import { parse } from "@wrnexus/syntax";
 
 export type InspectTarget =

packages/cli/test/authz-prod-coldstart.test.ts

@@ -80,43 +80,45 @@ export default authzMiddleware({ catalog: getAuthzCatalog(), store: memoryPermis
   });
 
   let port: number | undefined;
-  let stderrText = "";
   try {
     const reader = proc.stdout.getReader();
-    const errReader = proc.stderr.getReader();
     const decoder = new TextDecoder();
     let buffered = "";
-    const deadline = Date.now() + 20_000;
-    const TIMED_OUT = Symbol("timed out");
-    while (port === undefined && Date.now() < deadline) {
-      const outcome = await Promise.race([
-        reader.read(),
-        new Promise<typeof TIMED_OUT>((resolve) => setTimeout(() => resolve(TIMED_OUT), 250)),
-      ]);
-      if (outcome === TIMED_OUT) continue;
-      const { value, done } = outcome;
-      if (done) break;
-      buffered += decoder.decode(value);
-      const match = /listening on http:\/\/[^:]+:(\d+)/.exec(buffered);
-      if (match) port = Number(match[1]);
+
+    /*
+     * One outstanding read at a time, with the deadline enforced by killing
+     * the process rather than by racing the read.
+     *
+     * This loop used to race a FRESH reader.read() against a 250ms timer each
+     * pass. When the timer won, the abandoned read stayed pending and later
+     * resolved with the next chunk — which nothing was waiting for any more,
+     * so that output was dropped on the floor. On a loaded machine the very
+     * chunk carrying "listening on" could be swallowed, and the loop then
+     * spun to the full deadline and failed a server that had in fact started
+     * immediately. Reading without racing cannot lose a chunk: if the server
+     * really never starts, the kill below ends the stream and read() reports
+     * done.
+     */
+    const giveUp = setTimeout(() => proc.kill(), 20_000);
+    try {
+      while (port === undefined) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        buffered += decoder.decode(value, { stream: true });
+        const match = /listening on http:\/\/[^:]+:(\d+)/.exec(buffered);
+        if (match) port = Number(match[1]);
+      }
+    } finally {
+      clearTimeout(giveUp);
+      reader.releaseLock();
     }
-    reader.releaseLock();
 
     if (port === undefined) {
-      // Drain stderr for a useful failure message before giving up.
-      const errOutcome = await Promise.race([
-        errReader.read(),
-        new Promise<typeof TIMED_OUT>((resolve) => setTimeout(() => resolve(TIMED_OUT), 500)),
-      ]);
-      if (errOutcome !== TIMED_OUT && errOutcome.value) {
-        stderrText += decoder.decode(errOutcome.value);
-      }
-      errReader.releaseLock();
+      const stderrText = await new Response(proc.stderr).text().catch(() => "");
       throw new Error(
         `production server never printed a "listening on" line within 20s. stderr:\n${stderrText}`,
       );
     }
-    errReader.releaseLock();
 
     const response = await fetch(`http://127.0.0.1:${port}/api/health`);
     expect(response.status).toBe(200);