chore(web): address Copilot review on #2127

- Move REPLAYABLE_PROTOCOL_METHODS / isReplayableProtocolMethod out of
  components/groups/protocolUtils.ts into utils/replayableProtocolMethods.ts.
  It is a pure predicate over a string set, so by the project's own lib-vs-utils
  rule it never belonged under components/ — and keeping it there was what made
  lib/protocolReplay.ts import 'up' into the component graph. Both consumers now
  import from utils/; the predicate keeps its own test.

- Give replayProtocolRequest an exported ReplayClient = Pick<InspectorClient, ...>
  naming the nine methods it calls, so a caller (and the test) can satisfy the
  real contract instead of casting a stub into a whole client.

- Rebuild the protocolReplay fixtures as plain typed MessageEntry values. The
  double cast had been hiding a real defect: MessageEntry.timestamp is a Date
  and the fixture passed a number, so the assertion confirmed a shape
  messagesToLogEntries cannot produce.

- Replace the window casts in authToken.test.ts with Reflect.set /
  Reflect.deleteProperty. No 'as unknown as' remains in either test.

- Drop the stale 'floats top-right' sentence on ReAuthBannerBar, which moved
  verbatim and arrived contradicting the paragraph below it.

Declined: re-homing ReAuthBannerBar's transform/zIndex as a theme variant.
'styles' is the Styles API rather than an inline style, Mantine exposes neither
property as a prop, and a styling change is out of scope for a phase whose
safety argument is that nothing was edited.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/lib/protocolReplay.ts

@@ -5,8 +5,11 @@ import type {
 import type { InspectorClient } from "@inspector/core/mcp/index.js";
 import type { JsonValue } from "@inspector/core/mcp/index.js";
 import type { MessageEntry } from "@inspector/core/mcp/types.js";
+// Type-only, so this creates no runtime edge into `components/` and the
+// `components → lib → utils` direction still holds: `LogEntryData` is the shape
+// the Logs screen renders, and this module exists to produce exactly that.
 import type { LogEntryData } from "../components/elements/LogEntry/LogEntry";
-import { isReplayableProtocolMethod } from "../components/groups/protocolUtils.js";
+import { isReplayableProtocolMethod } from "../utils/replayableProtocolMethods";
 
 // Derive `LogEntryData[]` from the MessageLog by filtering for the
 // `notifications/message` notifications the server emits in response to
@@ -37,8 +40,26 @@ export function messagesToLogEntries(messages: MessageEntry[]): LogEntryData[] {
 // intentionally does NOT touch the Tools/Prompts/Resources panels. Returns a
 // human-readable reason when the entry can't be replayed (unsupported method,
 // or a tool that's no longer present), or null on a dispatched replay.
+/**
+ * The slice of `InspectorClient` a replay actually reaches. Naming it — rather
+ * than taking the whole client — is what lets a caller (and a test) supply a
+ * value that satisfies the real contract instead of casting one in.
+ */
+export type ReplayClient = Pick<
+  InspectorClient,
+  | "callTool"
+  | "getPrompt"
+  | "readResource"
+  | "listTools"
+  | "listPrompts"
+  | "listResources"
+  | "listResourceTemplates"
+  | "listRequestorTasks"
+  | "ping"
+>;
+
 export async function replayProtocolRequest(
-  client: InspectorClient,
+  client: ReplayClient,
   method: string,
   params: Record<string, unknown> | undefined,
   tools: Tool[],