fix: backdrops close on any click without checking gesture origin

[BorisTyshkevich]

What & why

Closes #110.

A browser's click fires on the nearest common ancestor of mousedown/mouseup, not the mousedown target. So any gesture that starts inside a modal's panel/card — e.g. dragging a text selection — but ends (mouseup) outside it produced a click whose target was the backdrop itself. The panel's own stopPropagation() never ran (the panel isn't in that click's path at all), so the drawer/dialog closed unexpectedly, discarding the in-progress selection.

Adds a shared attachBackdropClose(backdrop, close) (src/ui/dom.js) that tracks where mousedown actually landed (capturing on the backdrop itself) and only calls close() on the following click if that mousedown also landed on the backdrop — not merely wherever the click's target ends up. All five affected surfaces now share it instead of each pairing an onclick: close backdrop with an onclick: stopPropagation panel:

• results.js — the cell-detail drawer (openCellDetail) and the rows-viewer pane (openRowsViewer)
• detached-view.js — the graph overlay (openAsOverlay, shared by the schema graph / EXPLAIN pipeline / Data Pane expand)
• file-menu.js — the New-Library/Replace confirm dialog
• shortcuts.js — the keyboard-shortcuts modal

The cell-detail drawer's resize-drag one-shot click-swallow listener (#101) is superseded by this same general fix and removed.

Verification

Beyond the unit/e2e suites, manually verified live in a real Chromium browser via a throwaway Playwright harness driving real mouse events (mousedown → drag → mouseup → click): the drag-out-of-panel gesture no longer closes the drawer/modal, a genuine backdrop click still closes it, and Escape/✕ still close it. Confirmed the same harness fails against the pre-fix code, so the regression and the fix are both real.

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• No new runtime dependency
• README / CHANGELOG.md ([Unreleased]) updated
• Reconciled affected tracked work — self-contained inbox bugfix, not referenced by roadmap Roadmap to 1.0.0 #68

🤖 Generated with Claude Code