chore(web): address Copilot review on #2127

- Move REPLAYABLE_PROTOCOL_METHODS / isReplayableProtocolMethod out of
  components/groups/protocolUtils.ts into utils/replayableProtocolMethods.ts.
  It is a pure predicate over a string set, so by the project's own lib-vs-utils
  rule it never belonged under components/ — and keeping it there was what made
  lib/protocolReplay.ts import 'up' into the component graph. Both consumers now
  import from utils/; the predicate keeps its own test.

- Give replayProtocolRequest an exported ReplayClient = Pick<InspectorClient, ...>
  naming the nine methods it calls, so a caller (and the test) can satisfy the
  real contract instead of casting a stub into a whole client.

- Rebuild the protocolReplay fixtures as plain typed MessageEntry values. The
  double cast had been hiding a real defect: MessageEntry.timestamp is a Date
  and the fixture passed a number, so the assertion confirmed a shape
  messagesToLogEntries cannot produce.

- Replace the window casts in authToken.test.ts with Reflect.set /
  Reflect.deleteProperty. No 'as unknown as' remains in either test.

- Drop the stale 'floats top-right' sentence on ReAuthBannerBar, which moved
  verbatim and arrived contradicting the paragraph below it.

Declined: re-homing ReAuthBannerBar's transform/zIndex as a theme variant.
'styles' is the Styles API rather than an inline style, Mantine exposes neither
property as a prop, and a styling change is out of scope for a phase whose
safety argument is that nothing was edited.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/components/groups/ProtocolEntry/ProtocolEntry.tsx

@@ -30,8 +30,8 @@ import {
   extractMethod,
   extractResultType,
   extractSubscriptionId,
-  isReplayableProtocolMethod,
 } from "../protocolUtils.js";
+import { isReplayableProtocolMethod } from "../../../utils/replayableProtocolMethods";
 
 export interface ProtocolEntryProps {
   entry: MessageEntry;

clients/web/src/components/groups/ReAuthBanner/ReAuthBannerBar.tsx

@@ -3,12 +3,12 @@ import { Paper } from "@mantine/core";
 // The re-auth popup. A `Paper` so every static style is a prop; the stacking
 // order goes through `styles.root` since Mantine has no `z` prop.
 //
-// Floats top-right rather than spanning the top as a sticky full-bleed bar.
-// The bar cost the whole view a band of vertical space for what is a
-// notification about one server, and it sat directly above the monitoring
-// sidebar that an OAuth failure now opens (#2108) — the two things a user needs
-// at once here are this affordance and those requests, so it must not push them
-// around. `fixed`, not `sticky`, so scrolling the server list leaves it put.
+// Floats rather than spanning the top as a sticky full-bleed bar. The bar cost
+// the whole view a band of vertical space for what is a notification about one
+// server, and it sat directly above the monitoring sidebar that an OAuth
+// failure now opens (#2108) — the two things a user needs at once here are this
+// affordance and those requests, so it must not push them around. `fixed`, not
+// `sticky`, so scrolling the server list leaves it put.
 //
 // Centered, and deliberately WITHOUT an overlay. Every corner is spoken for —
 // the toast stack owns bottom-right (see `main.tsx`), the right edge is the

clients/web/src/components/groups/protocolUtils.ts

@@ -13,30 +13,6 @@ export function extractMethod(entry: MessageEntry): MessageMethod {
   return "response";
 }
 
-/**
- * Request methods the Protocol Replay action can re-issue (client→server reads
- * and calls). Server→client requests (roots/list, sampling, elicitation) and
- * side-effectful methods (logging/setLevel, subscribe) are intentionally
- * excluded. Single source of truth: `ProtocolEntry` hides the Replay button for
- * anything not listed here, and App's `replayProtocolRequest` gates dispatch on
- * the same set.
- */
-export const REPLAYABLE_PROTOCOL_METHODS: ReadonlySet<string> = new Set([
-  "tools/call",
-  "prompts/get",
-  "resources/read",
-  "tools/list",
-  "prompts/list",
-  "resources/list",
-  "resources/templates/list",
-  "tasks/list",
-  "ping",
-]);
-
-export function isReplayableProtocolMethod(method: string): boolean {
-  return REPLAYABLE_PROTOCOL_METHODS.has(method);
-}
-
 // --- Modern-era (2026-07-28) message vocabulary -----------------------------
 //
 // The modern era changes the over-the-wire conversation (spec §7.2–7.4): every