fix(ui): a toast host ranks by when its overlay opened, and an overlay keeps its Escape, its dialog and its navigation straight

Deep-review round 4, the overlays.

- Toast hosts were ranked by mount time, and PlayerModal swaps its host on every fullscreen change:
  leaving true fullscreen with the download dialog open put the player's host back on top, so toasts
  were drawn under that dialog's scrim and a click on one closed the dialog. Each overlay takes a
  rank once, when it opens (`useOverlayOrder`), and hands it to every host it renders.
- A dialog open while fullscreen is left keeps a stable portal container (moved, not re-created):
  React tore the portal down when `fsRoot` changed, resetting a half-filled form and dropping focus
  to <body>. Focus is put back after the move.
- The onboarding wizard is a layer, not a raw document listener: one Escape used to dismiss the
  error dialog over it AND end onboarding, skipping the write-scope step.
- `navigateTo` (a toast's "View", clicked inside the player's own host) goes over the overlays it
  unmounts, so the player's Back-to-close cleanup no longer pops the page it just opened — the same
  fix Shift+W already had. The access-requests toast action too.
- The live region arms itself a task after it takes over inherited toasts: React flushes effects in
  the same task as that render, so the "silent inheritance" arming was a no-op.
- The overlay-host guard matches class tokens in any order (PlexPlayer's root was never checked),
  globs `ui/` too (ui/Modal was not checked either), and requires the rank.

frontend/src/components/OnboardingWizard.tsx

@@ -7,7 +7,8 @@ import { api, type Me } from "../lib/api";
 import { beginGrant, endOnboarding } from "../lib/onboarding";
 import { Button } from "./ui/Button";
 import Overlay from "./ui/Overlay";
-import Toaster from "./ui/Toaster";
+import Toaster, { useOverlayOrder } from "./ui/Toaster";
+import { useLayer } from "../lib/layerStack";
 
 // A first-login wizard that walks the user through granting YouTube access one scope at a
 // time, each with a plain explanation and an up-front heads-up about Google's "unverified
@@ -103,15 +104,12 @@ export default function OnboardingWizard({ me, onClose }: { me: Me; onClose: ()
     endOnboarding(!me.can_read);
     onClose();
   };
+  const overlayOrder = useOverlayOrder(); // this overlay's toast-host rank (see ui/Toaster)
 
-  useEffect(() => {
-    function onKey(e: KeyboardEvent) {
-      if (e.key === "Escape") close();
-    }
-    document.addEventListener("keydown", onKey);
-    return () => document.removeEventListener("keydown", onKey);
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [me.can_read]);
+  // A layer in the shared stack, so Escape closes the wizard only when it is on top: a raw document
+  // listener ran BEFORE the error dialog's (a sync that failed inside the wizard opens one), and one
+  // Esc closed the error AND ended onboarding, skipping the write-scope step (deep-review round 4).
+  useLayer(true, close);
 
   // Are we currently importing (or about to)? Show a progress screen instead of the
   // "you're connected" step until the first import settles.
@@ -265,7 +263,7 @@ export default function OnboardingWizard({ me, onClose }: { me: Me; onClose: ()
         </div>
         {/* Toasts raised while the wizard is up (the connection notice among them) show above its
             scrim, not under it — see ui/Toaster. */}
-        <Toaster overlay />
+        <Toaster overlay order={overlayOrder} />
       </div>
     </Overlay>
   );