feat: quick-search fill modes + editable custom-field combobox + JS build gate

Quick search (Ctrl+Shift+Q fill mode)
- Enter / left-click → full autofill (username + Tab + password), like
  Ctrl+Shift+L.
- Shift+Enter / right-click → username only (new Delphi username-only
  SendInput path via field=user; ExecuteAutofill AUsernameOnly param).
- Ctrl+Enter / Ctrl+click → password only.
- Copy mode (tray / palette) unchanged: Enter/left = password,
  Shift+Enter/right = username.
- Clipboard fix: copy-then-minimise no longer wipes the just-copied
  password — MinimizeToTray takes an AClearClipboard flag (False on the
  quick-search copy path, driven by app/minimize?keepclip=1). The 30s
  auto-clear still guards it.
- Right-click on a result row suppresses the native/custom context menu
  (preventDefault + stopPropagation).

Editable custom-field combobox
- Option-backed custom fields (card brand, expiry year/month, etc.) now
  render a custom editable combobox instead of a locked <select>: an
  arrow drops a menu of ALL options (a native <datalist> filtered to the
  typed text, which confused users), while the input stays freely
  typeable for values not in the list. Storage shape unchanged.
- Outside-click closes the menu via the existing slideover mousedown
  handler; item mousedown + preventDefault so blur doesn't race the pick.

Build safety
- BuildAssets.ps1 runs `node --check` on every embedded .js before
  generating assets.res. A syntax error now aborts the asset build
  (exit 1, file + line logged) instead of shipping a dead bundle that
  only surfaces after a full Delphi rebuild. Node is optional: absent →
  warn and continue.

Docs
- CODE_AUDIT.md: full static-analysis report (security, latent bugs,
  maintainability, future features, prioritized action plan).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/UMainForm.pas

@@ -99,6 +99,9 @@ type
     // SendInput because Win10/11 anti-focus-stealing rules then refuse to
     // hand focus to the target window.
     FAutofillPendingHide: Boolean;
+    // True when the pending autofill should type ONLY the username (quick
+    // search "autofill username" — right-click / Shift+Enter in fill mode).
+    FAutofillPendingUserOnly: Boolean;
     // Created dynamically in FormCreate so the directive can pick either
     // TTMSFNCWebBrowser or TTMSFNCEdgeWebBrowser at compile time without
     // needing two .fmx variants. Aligned to Client to fill the remaining
@@ -788,6 +791,7 @@ begin
     FAutofillPendingPass := GetParam('password');
     FAutofillPendingHWND := FAutofillTargetHWND;
     FAutofillPendingHide := GetParam('hide_after') = '1';
+    FAutofillPendingUserOnly := GetParam('field') = 'user';
     FAutofillTargetHWND := 0;
 
     // Small timer so SetForegroundWindow has time to take effect before
@@ -823,7 +827,9 @@ begin
   // from the tray menu, hide it again so the user can paste straight
   // into the target app without alt-tabbing.
   else if ACmd = 'app/minimize' then
-    FBridge.MinimizeToTray
+    // keepclip=1 → don't wipe the clipboard on minimise (quick-search
+    // copy-then-hide flow). Default clears it as before.
+    FBridge.MinimizeToTray(GetParam('keepclip') <> '1')
 
   // Tray balloon notifications on/off. JS pushes the user setting at
   // startup (settings_json sync) and whenever they flip the toggle.
@@ -1323,22 +1329,24 @@ procedure TMainForm.AutofillTimerTick(Sender: TObject);
 var
   TargetHwnd: HWND;
   PendingUser, PendingPass: string;
-  HideAfter: Boolean;
+  HideAfter, UserOnly: Boolean;
   ForegroundAfter: HWND;
 begin
   TargetHwnd  := FAutofillPendingHWND;
   PendingUser := FAutofillPendingUser;
   PendingPass := FAutofillPendingPass;
   HideAfter   := FAutofillPendingHide;
+  UserOnly    := FAutofillPendingUserOnly;
   FAutofillPendingHWND := 0;
   FAutofillPendingUser := '';
   FAutofillPendingPass := '';
   FAutofillPendingHide := False;
+  FAutofillPendingUserOnly := False;
 
   TTimer(Sender).Enabled := False;
   TTimer(Sender).Free;
 
-  FBridge.ExecuteAutofill(TargetHwnd, PendingUser, PendingPass);
+  FBridge.ExecuteAutofill(TargetHwnd, PendingUser, PendingPass, UserOnly);
   ForegroundAfter := GetForegroundWindow;
   LogLine(Format('Autofill executed — target=%s, foreground_after=%s, match=%s',
     [IntToHex(TargetHwnd, 8), IntToHex(ForegroundAfter, 8),