fix(identity): clear a copied private key, name restore failures, fix storage copy - #3236

Summary

• Clipboard: Copy private key left the nsec on the clipboard indefinitely, and in clipboard history. Now the host writes it on every platform, marked as sensitive so clipboard managers and Windows clipboard history and cloud sync skip it. 60 seconds after the latest key copy it tries to clear the clipboard, if the clipboard still holds that key. The copy message says Buzz tries to clear it.
• Restore errors: a restore from backup reported almost every failure as "Could not restore your identity. Try again." Now a browser sign-in the user declined reads as Restore was canceled, a browser step that timed out says so, and no answer from Builderlab (network, DNS, TLS) reads as Couldn't reach Builderlab. Check your connection and try again. Other failures keep the generic text.
• Unreadable org sign-in: a saved organization sign-in that native can't read (storage-corrupt) told the user to check credential permissions. Now it says Buzz can't read it, that signing in again may not replace it, and to contact support if it keeps happening. It doesn't suggest Sign out of Buzz: that deletes a damaged record, but not duplicate Linux keyring items, which report the same code.
• Copy: the "a different key is already saved" refusal said "This Mac" on Windows and Linux too. It now says "this computer".

Details

• src-tauri/src/clipboard.rs: clipboard_write_text takes an optional clear_after_secs (capped at 10 minutes). With it, the text is set with arboard's history exclusion (exclude_from_history on macOS and Linux, exclude_from_monitoring on Windows). The copied text is held in Zeroizing buffers in Buzz's code. copy_secret counts a copy only after it was written; after the delay, clear_secret clears only if no later counted copy happened and the clipboard text still equals it. Both run on the main thread with the clipboard held. No new command or permission.
• src/shared/clipboard.ts: writeClipboardSecret uses that host path on every platform (a browser build can't read the clipboard back, so there it only copies). PrivateKey uses it for Copy private key.
• src-tauri/src/nsec_backup.rs:
  • The OAuth callback's error=access_denied maps to CANCELED. Other error values stay RETRY.
  • The callback's own timeout passes through as oauth_callback::TIMED_OUT.
  • A new OFFLINE message covers a failed send on the code exchange, a failed send on account reads (new ReadError::Unreachable), and the backup client's Transport error. A backup pass still reports Unreachable as before.
• src/features/federated-identity/CommunitySignIn.tsx: recoveryMessage has its own text for storage-corrupt. Other storage-* codes keep the permissions text.
• src/features/identity/setup.ts: "This Mac" → "this computer".
• docs/identity.md and docs/buzz-help.md describe the clipboard and restore rules.
• Tests:
  • Native: a declined browser sign-in is CANCELED and another error is RETRY, both with no account request. An unreachable service is OFFLINE, and a backup pass still maps it to Unreachable.
  • Native (clipboard.rs, fake clipboard): a copy is cleared when its wait ends; a second copy of the same key keeps the first wait from clearing it; a failed second copy leaves the first clear in place; anything else on the clipboard is left alone.
  • The copy test runs as Linux and expects the host write with clearAfterSecs: 60.
  • CommunitySignIn shows the unreadable-sign-in text for storage-corrupt and not the permissions text.

Known limits

• A key the user selects and copies by hand from the revealed field is not cleared, unless a Copy private key wait is still running.
• The history exclusion is a hint. A clipboard manager that ignores it still records the key.
• The Windows and Linux exclusion paths compile only on those platforms; CI builds them.
• The clear runs in the app. If Buzz quits within the minute, the key stays on the clipboard. Clear failures are ignored, and another app can write between the read and the clear.
• The import-before-link case from the same audit is not changed here. The import page's link step runs only for a signed-in account with no linked key, and no path into the import page reaches it with one. The entry points checked were the connect choice, Welcome back, the restore page and a community that isn't hosted.

🤖 Generated with Claude Code