fix(ui): use HTTP-safe clipboard copy everywhere

[cryppadotta]

Thinking Path

• Paperclip is the open source app people use to manage AI agents for work.
• Operators often open self-hosted Paperclip over plain HTTP on a LAN or private network.
• Browser Clipboard API writes are not reliable in that insecure context.
• Paperclip already has one shared helper with a legacy copy fallback, but many current copy actions bypass it.
• This pull request routes every core UI copy action and the first-party workspace-diff plugin through the shared helper.
• The benefit is consistent copy behavior on HTTPS, localhost, and plain-HTTP private deployments.

Linked Issues or Issue Description

Refs #3529.

This change supersedes the stale prior attempt in #3531. Current master has more copy surfaces and a first-party plugin UI bridge that the prior branch does not cover.

What Changed

• Replaced direct Clipboard API writes and duplicate fallback implementations across the current core UI with copyTextToClipboard.
• Added an HTTP-safe clipboard function to the plugin UI SDK and wired the host bridge to the same implementation.
• Migrated the first-party workspace-diff plugin to the plugin SDK clipboard function.
• Added unit coverage for native rejection fallback and plugin host delegation.
• Added a source-level regression test that rejects new direct clipboard writes outside the shared implementation.
• Documented the plugin UI clipboard function.

Verification

• NODE_ENV=test pnpm exec vitest run ... for 14 affected suites: 164 tests passed.
• pnpm exec vitest run tests/ui-clipboard.test.ts in packages/plugins/sdk: 1 test passed.
• NODE_ENV=test pnpm -r typecheck: passed for 31 workspace projects.
• NODE_ENV=test pnpm test:run: passed.
• NODE_ENV=production pnpm build: passed.
• pnpm check:token-gates: passed with all gates clean.

Risks

Low risk. Secure contexts still use the modern Clipboard API. Plain HTTP and rejected modern writes use the existing execCommand("copy") fallback. That API is deprecated, but it is the compatibility path required for insecure contexts. The change has no schema, API, or visual design effect.

For core feature work, check ROADMAP.md first and discuss it in #dev before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See CONTRIBUTING.md.

Model Used

OpenAI Codex, gpt-5.6-sol. The runtime did not expose a context-window size. Reasoning, tool use, repository editing, test execution, and GitHub CLI access were enabled.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have not referenced internal/instance-local Paperclip issues or links (only public GitHub #NNN / github.com/paperclipai/paperclip URLs)
• My branch name describes the change (e.g. docs/..., fix/...) and contains no internal Paperclip ticket id or instance-derived details
• I have run tests locally and they pass
• I have added or updated tests where applicable
• I have updated relevant documentation to reflect my changes
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[greptile-apps]

Greptile Summary

The PR centralizes clipboard writes so core UI and first-party plugin copy actions use the HTTP-compatible fallback.

• Exposes the shared clipboard operation through the plugin UI SDK and host bridge.
• Migrates direct and duplicated clipboard implementations across the UI.
• Adds fallback, host-delegation, and source-level regression coverage.
• Documents the plugin SDK clipboard API.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
ui/src/lib/clipboard.ts	Broadens secure-context detection and retains native-write rejection fallback to the legacy copy path.
packages/plugins/sdk/src/ui/clipboard.ts	Adds a typed plugin SDK wrapper that delegates clipboard writes to the host UI runtime.
ui/src/plugins/bridge-init.ts	Registers the shared host clipboard helper in the plugin UI bridge initialized before rendering.
ui/src/plugins/slots.tsx	Re-exports the clipboard bridge function through dynamically generated plugin SDK UI shims.
packages/plugins/plugin-workspace-diff/src/ui/index.tsx	Routes workspace-diff path copying through the plugin SDK clipboard helper.
ui/src/lib/clipboard-usage.test.ts	Adds a regression test preventing direct clipboard writes outside the shared implementation.

_{Reviews (2): Last reviewed commit: "fix(ui): initialize copy failure toast i..." | Re-trigger Greptile}