feat: quick-search fill modes + editable custom-field combobox + JS build gate

Quick search (Ctrl+Shift+Q fill mode)
- Enter / left-click → full autofill (username + Tab + password), like
  Ctrl+Shift+L.
- Shift+Enter / right-click → username only (new Delphi username-only
  SendInput path via field=user; ExecuteAutofill AUsernameOnly param).
- Ctrl+Enter / Ctrl+click → password only.
- Copy mode (tray / palette) unchanged: Enter/left = password,
  Shift+Enter/right = username.
- Clipboard fix: copy-then-minimise no longer wipes the just-copied
  password — MinimizeToTray takes an AClearClipboard flag (False on the
  quick-search copy path, driven by app/minimize?keepclip=1). The 30s
  auto-clear still guards it.
- Right-click on a result row suppresses the native/custom context menu
  (preventDefault + stopPropagation).

Editable custom-field combobox
- Option-backed custom fields (card brand, expiry year/month, etc.) now
  render a custom editable combobox instead of a locked <select>: an
  arrow drops a menu of ALL options (a native <datalist> filtered to the
  typed text, which confused users), while the input stays freely
  typeable for values not in the list. Storage shape unchanged.
- Outside-click closes the menu via the existing slideover mousedown
  handler; item mousedown + preventDefault so blur doesn't race the pick.

Build safety
- BuildAssets.ps1 runs `node --check` on every embedded .js before
  generating assets.res. A syntax error now aborts the asset build
  (exit 1, file + line logged) instead of shipping a dead bundle that
  only surfaces after a full Delphi rebuild. Node is optional: absent →
  warn and continue.

Docs
- CODE_AUDIT.md: full static-analysis report (security, latent bugs,
  maintainability, future features, prioritized action plan).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/assets/BuildAssets.ps1

@@ -77,6 +77,33 @@ if ($files.Count -eq 0) {
 Log "Embedding $($files.Count) file(s):"
 $files | ForEach-Object { Log ("  " + $_.UrlPath + "  ->  " + $_.ResName) }
 
+# --- JS syntax gate -----------------------------------------------------------
+# A syntax error in app.js parses fine here but kills the whole frontend at
+# runtime (no event handlers → dead UI), and it's only caught after a full
+# Delphi rebuild. Run `node --check` on every embedded .js so a broken bundle
+# never makes it into assets.res. Node is optional: if it isn't installed we
+# warn and continue rather than blocking the build on a machine without it.
+$node = Get-Command node.exe -ErrorAction SilentlyContinue
+if (-not $node) { $node = Get-Command node -ErrorAction SilentlyContinue }
+$jsFiles = $files | Where-Object { $_.Relative -match '\.js$' }
+if ($jsFiles) {
+    if ($node) {
+        foreach ($jf in $jsFiles) {
+            Log "Syntax check: $($jf.Relative)"
+            # --check prints errors to stderr and returns non-zero on failure.
+            $out = & $node.Source --check $jf.FullPath 2>&1
+            if ($LASTEXITCODE -ne 0) {
+                Log "JS SYNTAX ERROR in $($jf.Relative):"
+                Log ($out | Out-String)
+                throw "JS syntax check failed for $($jf.Relative) - aborting asset build."
+            }
+        }
+        Log "JS syntax OK."
+    } else {
+        Log "WARNING: node not found - skipping JS syntax check. Install Node to enable it."
+    }
+}
+
 # --- Generate assets.rc -------------------------------------------------------
 $rc = New-Object System.Text.StringBuilder
 [void]$rc.AppendLine('// Auto-generated by BuildAssets.ps1 - do not edit by hand.')