chore(web): address Copilot review on #2127

- Move REPLAYABLE_PROTOCOL_METHODS / isReplayableProtocolMethod out of
  components/groups/protocolUtils.ts into utils/replayableProtocolMethods.ts.
  It is a pure predicate over a string set, so by the project's own lib-vs-utils
  rule it never belonged under components/ — and keeping it there was what made
  lib/protocolReplay.ts import 'up' into the component graph. Both consumers now
  import from utils/; the predicate keeps its own test.

- Give replayProtocolRequest an exported ReplayClient = Pick<InspectorClient, ...>
  naming the nine methods it calls, so a caller (and the test) can satisfy the
  real contract instead of casting a stub into a whole client.

- Rebuild the protocolReplay fixtures as plain typed MessageEntry values. The
  double cast had been hiding a real defect: MessageEntry.timestamp is a Date
  and the fixture passed a number, so the assertion confirmed a shape
  messagesToLogEntries cannot produce.

- Replace the window casts in authToken.test.ts with Reflect.set /
  Reflect.deleteProperty. No 'as unknown as' remains in either test.

- Drop the stale 'floats top-right' sentence on ReAuthBannerBar, which moved
  verbatim and arrived contradicting the paragraph below it.

Declined: re-homing ReAuthBannerBar's transform/zIndex as a theme variant.
'styles' is the Styles API rather than an inline style, Mantine exposes neither
property as a prop, and a styling change is out of scope for a phase whose
safety argument is that nothing was edited.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/utils/replayableProtocolMethods.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import {
+  isReplayableProtocolMethod,
+  REPLAYABLE_PROTOCOL_METHODS,
+} from "./replayableProtocolMethods";
+
+describe("isReplayableProtocolMethod", () => {
+  it("admits every client→server read and call in the set", () => {
+    for (const method of REPLAYABLE_PROTOCOL_METHODS) {
+      expect(isReplayableProtocolMethod(method)).toBe(true);
+    }
+    expect([...REPLAYABLE_PROTOCOL_METHODS].sort()).toEqual([
+      "ping",
+      "prompts/get",
+      "prompts/list",
+      "resources/list",
+      "resources/read",
+      "resources/templates/list",
+      "tasks/list",
+      "tools/call",
+      "tools/list",
+    ]);
+  });
+
+  it("excludes server→client requests and side-effectful methods", () => {
+    for (const method of [
+      "roots/list",
+      "sampling/createMessage",
+      "elicitation/create",
+      "logging/setLevel",
+      "resources/subscribe",
+      "initialize",
+    ]) {
+      expect(isReplayableProtocolMethod(method)).toBe(false);
+    }
+  });
+});

clients/web/src/utils/replayableProtocolMethods.ts

@@ -0,0 +1,28 @@
+/**
+ * Request methods the Protocol Replay action can re-issue (client→server reads
+ * and calls). Server→client requests (roots/list, sampling, elicitation) and
+ * side-effectful methods (logging/setLevel, subscribe) are intentionally
+ * excluded. Single source of truth: `ProtocolEntry` hides the Replay button for
+ * anything not listed here, and `replayProtocolRequest` gates dispatch on the
+ * same set.
+ *
+ * Lives in `utils/` rather than beside the Protocol components because it is a
+ * pure predicate over a string set with two consumers on opposite sides of the
+ * layering: a component and `lib/protocolReplay.ts`. Keeping it here is what
+ * lets the adapter reach it without importing "up" into `components/`.
+ */
+export const REPLAYABLE_PROTOCOL_METHODS: ReadonlySet<string> = new Set([
+  "tools/call",
+  "prompts/get",
+  "resources/read",
+  "tools/list",
+  "prompts/list",
+  "resources/list",
+  "resources/templates/list",
+  "tasks/list",
+  "ping",
+]);
+
+export function isReplayableProtocolMethod(method: string): boolean {
+  return REPLAYABLE_PROTOCOL_METHODS.has(method);
+}