Avoid clipboard prompts in embedded live views

[masnwilliams]

summary

• avoid requesting clipboard-read permission from embedded live views during focus and mouse entry
• continue proactive clipboard sync when an embed already has permission
• leave top-level live-view clipboard behavior unchanged

why

A clipboard permission prompt can take keyboard focus from a cross-origin live-view iframe while mouse input continues through its independent handler. The overlay remains the active element inside the iframe, but trusted key events no longer reach it.

The native paste path already reads ClipboardEvent.clipboardData, so embedded users can still paste without triggering a permission request.

validation

Tested against exact image kernel-cu-v63:863808b using Chromium 151, fresh viewer profiles, trusted OS-level input, client-stage counters, privacy-safe Neko receipt/injection markers, and a remote input assertion.

• baseline: clipboard permission remained prompt, iframe focus dropped, client sent the mouse down, Neko received/authorized/injected both pointer events, and 0/5 keys reached the client or server
• patched: iframe focus remained active, 5/5 keys reached the client, Neko received/authorized/injected all 10 key down/up packets, and the remote input received all five characters
• direct top-level control: 5/5 fresh-profile runs retained focus and delivered all keys, confirming this change remains scoped to the embedded failure
• native paste delivered the exact fixture through the embedded live view
• bun run lint --no-fix (0 errors; existing warnings)
• bun run build (passes; existing lint and bundle-size warnings)