fix(diagnostics): deep-review round 1 — a send that cannot race, lose or repeat itself

The send, the draft and the screenshots take the session's row lock, so an
autosave or a paste during a send waits for it and then sees it, and two sends
cannot open two issues. A save keeps the delivery's progress; a failed edit
that shows the screenshots is finished by the retry; an answer that is not the
tracker's API (a redirect, a proxy page) is refused, not a crash that loses the
issue's record. Only an attempt that opened an issue counts toward the pace.

Screenshots: deleting one after the send is refused, a user's storage is
capped across sessions, new sessions and zip exports are paced, images are
stored uncompressed in the zip. One liveness rule, one session view, one image
type table.

Logging: a session's elevation is tracked apart from the user's own, so the
browser's own requests (no header) no longer lower the floor a session needs;
Stop ends it at once.

Composer: an image pasted anywhere is taken; what is still unsaved is saved on
close, and "saved" is shown only when it is; the draft is held while it is
sent; a failed screenshot read says so instead of reading as none; focus moves
to what stays; the preview follows the text size. Pill: the step prompt and a
running Stop survive the pill moving between hosts, the prompt keeps the
dialog's Tab trap, the toast region lets clicks through, other tabs hear of a
Start or Stop, the last seconds are sent before the cap, a capture with no
frame is an error.

frontend/src/lib/diagnostics.session.dom.test.ts

@@ -131,6 +131,16 @@ describe("a debug session applied to the tab", () => {
     expect(codes).toEqual(expect.arrayContaining(["ui.before", "ui.after"]));
   });
 
+  it("its last seconds are sent before its cap, while the server still tags them", async () => {
+    const d = await fresh();
+    d.applyDiagnostics(BASE, recording("DEBUG", 1), () => {});
+    await vi.advanceTimersByTimeAsync(57_000); // the regular flushes ran; the next is past the cap
+    d.log.info("debug.step", "the last step");
+    await vi.advanceTimersByTimeAsync(2_000); // 59 s: the cap is still a second away
+    const step = flat().find((e) => e.event === "debug.step");
+    expect(step?.debug_session_id).toBe("0123456789abcdef");
+  });
+
   it("flushNow sends what is waiting at once — before Stop closes the session", async () => {
     const d = await fresh();
     d.applyDiagnostics(BASE, recording("DEBUG"), () => {});