fix(autofill): refusing a request must not move any window

The busy guard cancelled through the path that hands the foreground back to the captured target. During an export that pushed the native Save dialog behind the other application, leaving the app disabled by a modal the user could no longer find. refocus=0 separates refusing a request from ending a user interaction.

js/app.autofill.js

@@ -242,7 +242,10 @@ async function autofillHandleRequest(windowTitle, kind) {
     // window and hand the foreground away mid-operation. cancelAutofill so
     // Delphi doesn't keep the captured target HWND for a fill that never comes.
     if (typeof isBusy === 'function' && isBusy()) {
-        Bridge.cancelAutofill();
+        // refocus=false: refusing must not move any window. During an export a
+        // native Save dialog holds the foreground, and shoving it behind leaves
+        // the app disabled by a modal the user can no longer find.
+        Bridge.cancelAutofill(false);
         toast('Busy — try again in a moment', 'warning');
         return;
     }

js/app.js

@@ -177,10 +177,14 @@ const Bridge = (() => {
             cmd('cmd://app/theme?mode=' + (mode === 'light' ? 'light' : 'dark'));
         },
 
-        // Tell Delphi we couldn't find a match / user cancelled.
-        cancelAutofill() {
+        // Tell Delphi we couldn't find a match / user cancelled. It normally
+        // hands the foreground back to the captured target — pass false when
+        // merely REFUSING a request, so nothing on screen moves. A native Save
+        // dialog owns the foreground during an export, and pushing it behind
+        // leaves the app disabled by a modal the user can no longer see.
+        cancelAutofill(refocus = true) {
             if (!active) return;
-            cmd('cmd://autofill/cancel');
+            cmd('cmd://autofill/cancel' + (refocus ? '' : '?refocus=0'));
         },
 
         // Sync the hotkey registration state with this device's preference.