fix(diagnostics): deep-review round 3 — a keyboard owner that is not a Tab trap

Round 2 made the step prompt a blocking layer so that `j` and the `g` chords
would not reach the page behind it. The dialog it sits in gave up its Tab trap
because of that, while the prompt's own replacement trap covered only its own
two controls — so Tab from anywhere else in the dialog (the bar's Screenshot or
Stop, the dialog's own buttons) walked out behind the scrim. `layerStack` now
separates the two questions it had folded into one flag: a layer can own the
keyboard and still leave the Tab trap to the dialog below it. The mirror case,
a dialog opening over the prompt, falls out of the same split.

A send's claim is now a lease with an owner. Every progress report re-stamps
it, so a send slower than the lease cannot lose it while it is still running,
and only the send that took a claim can give it back. The issue_create audit
row is staged inside the send and rides the same checkpoint as `issue_url`, so
the trail cannot be missing for an issue that exists. The attachment-name
prefix has one definition, shared by the producer and both readers.

A running send is reported to the UI. A reload or a second tab used to render
it exactly like a send that STOPPED, and offered a retry the server was certain
to refuse; the composer now says the report is being sent, holds the draft, and
puts both the retry and Create issue out. The past-sessions list says the same
for the same reason — it is the list a user opens to check on a send, and both
"draft" and "half sent" describe one that died. `/preview` and the retry path
got a pace of their own, and the per-user byte cap took the user-scoped lock
that makes it a cap instead of a guess.

Verified in a real browser on localdev: Tab cycles the whole dialog with the
prompt open, the prompt still swallows the page's keys, and the issue link is
focusable where the composer puts it. All 24 regression tests mutation-checked.

backend/app/routes/debug_sessions.py

@@ -188,6 +188,15 @@ def export_session(
 # one, or an attempt refused before the tracker was asked, is not counted. The composer sends one at
 # a time; this is room for a bad afternoon, not a pace anything legitimate keeps up.
 _new_issues = RateLimiter(max_events=5, window_seconds=3600)
+# Attempts on the tracker per hour, creating or finishing. Deliberately NOT the budget above: a
+# half-sent issue must always be finishable, so the pace that guards creating one must never be what
+# stands between a user and their own report. This one only bounds a loop — every attempt re-reads
+# the whole bundle into memory and re-offers the pending file to the tracker, and a retry that is
+# refused for good (the tracker's own limits) never leaves `pending`. No hand reaches it.
+_sends = RateLimiter(max_events=60, window_seconds=3600)
+# The composer's live preview, rendered BY the tracker: one authenticated call each, with our token.
+# react-query debounces it to a handful a minute; this bounds what a loop can aim at the tracker.
+_previews = RateLimiter(max_events=60, window_seconds=60)
 
 
 def _issues_rate_limited() -> HTTPException:
@@ -216,7 +225,9 @@ def send_issue(
             raise refused(422, "issue_title_required")
         if _new_issues.exhausted(key):
             raise _issues_rate_limited()
-    debugsession.claim_send(session)
+    if not _sends.allow(key):
+        raise refused(429, "issue_rate_limited", limit=_sends.max_events)
+    token = debugsession.claim_send(session)
     db.commit()  # the claim is what everything else sees; the lock ends here
 
     def count_new_issue() -> None:
@@ -224,7 +235,13 @@ def send_issue(
             raise _issues_rate_limited()
 
     try:
-        gitea.deliver(db, session, checkpoint=db.commit, before_create=count_new_issue)
+        gitea.deliver(
+            db,
+            session,
+            checkpoint=db.commit,
+            before_create=count_new_issue,
+            on_created=lambda: _record_created(db, user, session),
+        )
     except gitea.GiteaError as exc:
         # Keep what did happen: an issue created before an upload failed stays linked, and the
         # retry does only what is still missing.
@@ -232,18 +249,17 @@ def send_issue(
     except HTTPException:
         raise  # the pace, refused before the tracker was asked
     finally:
-        _end_send(db, user, session, new)
+        _end_send(db, session, token)
     return {"ok": True, "session": _view(db, session)}
 
 
-def _end_send(db: Session, user: User, session: DebugSession, new: bool) -> None:
-    """Give the claim back, and record an issue this send opened — whatever else happened. A
-    failure here must not replace the failure that brought us: a dead transaction (the database
-    went away mid-send) is rolled back, and the claim then simply ages out."""
+def _end_send(db: Session, session: DebugSession, token: str) -> None:
+    """Give the claim back, whatever else happened. A failure here must not replace the failure that
+    brought us: a dead transaction (the database went away mid-send) is rolled back, and the claim
+    then simply ages out."""
     try:
         debugsession.lock(db, session)
-        debugsession.release_send(session)
-        _record_created(db, user, session, new)
+        debugsession.release_send(session, token)
         db.commit()
     except Exception:  # noqa: BLE001 — whatever went wrong here, the send's own failure is the news
         db.rollback()
@@ -253,16 +269,19 @@ def _end_send(db: Session, user: User, session: DebugSession, new: bool) -> None
         )
 
 
-def _record_created(db: Session, user: User, session: DebugSession, new: bool) -> None:
-    if new and session.issue_url:
-        audit.record(
-            db,
-            user.id,
-            AuditAction.ISSUE_CREATE,
-            target_type="debug_session",
-            target_id=session.id,
-            summary=session.issue_url,
-        )
+def _record_created(db: Session, user: User, session: DebugSession) -> None:
+    """The trail for the one act that takes a user's log off this instance. Staged inside the send,
+    so the checkpoint that first writes `issue_url` commits BOTH — recorded later it could be lost
+    on its own (the process dies mid-send), and no retry could write it afterwards: the next send
+    sees the link and knows the issue is not new."""
+    audit.record(
+        db,
+        user.id,
+        AuditAction.ISSUE_CREATE,
+        target_type="debug_session",
+        target_id=session.id,
+        summary=session.issue_url or "",
+    )
 
 
 class PreviewIn(BaseModel):
@@ -279,6 +298,8 @@ def preview_issue(
     """The body as the tracker will render it. Gitea sanitises its own output; the composer still
     shows it in a sandboxed frame, never in the app's own document."""
     owned_or_404(db, DebugSession, sid, user, what="debug_session")
+    if not _previews.allow(str(user.id)):
+        raise refused(429, "preview_rate_limited")
     try:
         return {"ok": True, "html": gitea.preview(db, body.text)}
     except gitea.GiteaError as exc: