feat(app): add miner command copy actions

[mkdev5]

Summary

• Adds miner-dashboard MCP command copy actions for install, status, doctor, plan, preflight, and packet.
• Builds snippets from the authenticated miner session plus live dashboard repo context, with context-aware disabled states when repo/login data is missing.
• Keeps the command strip visible ahead of the dashboard state boundary so loading, empty, error, and API-unreachable dashboard states still provide safe local next steps.
• Sanitizes command snippets to avoid local absolute paths and sensitive private terms.

Closes #241

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

Verified locally with npm run test:ci from the repo root.

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (statements 99.04%, branches 97.02%, functions 98.39%, lines 99.61%)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate (0 vulnerabilities)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Focused regression coverage:

• test/unit/miner-dashboard-commands.test.ts covers ready command state, missing repo context, disabled repo-bound commands, and path/private-term redaction.

If any required check was skipped, explain why:

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No auth, cookie, CORS, Cloudflare, dependency, OpenAPI, or MCP contract changes.
• No docs or changelog updates needed for this focused UI surface.
• The screenshot run used the built Wrangler preview at /app/miner and mocked only /health, /v1/auth/session, and /v1/app/miner-dashboard to provide an authenticated dashboard state for evidence. Production behavior remains wired to the live API/session hooks.

UI Evidence

Desktop:

Narrow viewport:

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#422 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[mkdev5]

@JSONbored fixed the conflicts

[JSONbored]

Reviewed the UI/helper patch, tests, screenshots, and current CI state. The command snippets stay disabled without login/repo context, the repo/login values are sanitized before becoming copyable, and the command strip uses live session/dashboard state rather than static production mock data. CI is green. No merge action taken.