fix(admin): rewire dead sourcebans.js helpers across admin surfaces (#1402) - #1408

…1402)

Sweeps the post-#1397 cluster of admin surfaces where the click chain
dead-ended at a helper deleted with `web/scripts/sourcebans.js` at
#1123 D1. Same shape as #1397's `RemoveMod` fix (silent / loud
`ReferenceError` on every click), applied to the rest of the cluster:

- **Mods → Add new MOD → Submit** (`ProcessMod`): the form's
  `onsubmit="return ProcessMod()"` referenced a v1.x helper that
  validated input + called `sb.api.call(Actions.ModsAdd)`. Replaced
  with an inline page-tail dispatcher that intercepts `submit`,
  runs the same client-side gates (name + URL + icon non-empty),
  then `sb.api.call(Actions.ModsAdd, …)` per the
  `page_admin_groups_add.tpl` reference shape. `setBusy` flips the
  three-attribute busy contract during the in-flight call.

- **Mods → Upload icon popup** (`window.opener.icon(...)`):
  `UploadHandler::handle()` emits `<script>window.opener.icon(filename)</script>`
  on successful upload, but `window.icon` was undefined in both
  `page_admin_mods_add.tpl` (new-mod flow) and `page_admin_edit_mod.tpl`
  (edit-mod flow), so the popup never closed and the icon filename
  never landed on the parent's `#icon_hid` hidden input. Both
  templates now define `window.icon = function (filename) { … }`
  inside a `{literal}…{/literal}` block that patches the hidden
  input + updates the visible affordances (preview / "Choose file"
  label). Same shape `window.demo` uses on the ban pages.

- **Admins → Add new admin → Submit** (`ProcessAddAdmin`): same
  shape as `ProcessMod`. Intercept submit, validate (username +
  password + SteamID + server-group + web-group), then
  `sb.api.call(Actions.AdminsAdd)`. `event.preventDefault()` blocks
  the native fallback POST so a JSON failure no longer races a
  full-page reload.

- **Admins → Add → Generate password button** (`LoadGeneratePassword`):
  rewired to `sb.api.call(Actions.AdminsGeneratePassword)`; success
  fills both `password` + `confirm` inputs in place. No CSRF
  surface (read-only call).

- **Admins → Add → server / web permissions `<select>` reveal**
  (`update_server` / `update_web`): the conditional dependent-input
  reveal (Custom permissions → flag picker; New admin group →
  new-name + SM flags) is pure client-side DOM. Replaced the two
  dead helpers with `data-action="adminadd-update-server" /
  "adminadd-update-web"` `<select>` change handlers that toggle
  the right `hidden` attributes per the original v1.x semantics.

- **Comms → Edit block → submit with validation error**
  (`window.addEvent('domready', …)`): the MooTools DOMready wrapper
  in `$errorScript` referenced an undefined global, so the
  validation-error toast never painted. Per scope guardrails on
  this issue, I dropped the MooTools wrapper and replaced its
  body with vanilla `document.addEventListener('DOMContentLoaded',
  …)` calling `window.SBPP.showToast` directly. The matching
  `$('id').innerHTML` / `setStyle` calls inside the
  `changeReason()` helper became
  `document.getElementById('id').textContent` /
  `el.style.display = 'block'`. The broader sweep of
  `<script>ShowBox(...)</script>` toast blobs across other pages
  stays for #1403.

- **Bans → Group ban — URL submit + bulk-from-friends**
  (`LoadGroupBan` / `ProcessGroupBan` / `CheckGroupBan`): chained
  through a page-tail dispatcher in `admin.bans.php` that picks
  up `data-action="groupban-submit" / "groupban-bulk-submit"`
  and walks the legacy two-step
  `Actions.BansGroupBan` → `Actions.BansBanMemberOfGroup` chain.
  The first step parses the URL into a group name, the second
  enumerates + bans members. Bulk path tracks the `last` checkbox
  sentinel so a 20-group bulk-ban only fires one success toast.
  No new `Actions.GroupbanCheck` was needed — `bans.group_ban`
  IS the URL-parse step `LoadGroupBan` used to perform first.

- **Bans → Group ban → Tick select-all** (`TickSelectAll`):
  rewired to `data-action="groupban-select-all"` (covers both
  the table-header button + the "Select all" link below).
  Toggle state is computed from the `chkb_<n>` checkboxes' live
  state per the v1.x semantics (any-unchecked → check all;
  all-checked → uncheck all).

- **Banlist / Commslist / admin.bans comment editor trash**
  (`RemoveComment`): the four call sites (page.banlist.php,
  page.commslist.php, admin.bans.php protests + submissions)
  used to inline the same dead helper. Replaced with a single
  shared `web/scripts/comment-actions.js` dispatcher loaded
  from `core/footer.tpl` (`<script src="./scripts/comment-actions.js" defer>`).
  Each trigger emits `data-action="comment-delete"` +
  `data-cid="<int>"` + `data-ctype="<B|C|S|P>"` + `data-page="<int>"`;
  the dispatcher `window.confirm`s the destructive intent, then
  `sb.api.call(Actions.BansRemoveComment, { cid, ctype, page })`.
  The `ctype` letter matches `:prefix_comments.type` (B=ban,
  C=comm-block, S=submission, P=protest); `api_bans_remove_comment`'s
  `ctype` arm consumes all four. Single mount point is the
  contract — don't duplicate inline per page.

E2E regression coverage
-----------------------
Four new specs under `web/tests/e2e/specs/flows/`:

- `mods-add-form.spec.ts` — happy-path submit + missing-icon
  client-side gate. Stubs `Actions.ModsAdd` via `page.route`
  to assert the wire format without mutating the e2e DB.

- `admins-add-form.spec.ts` — happy-path submit, Generate-password
  button fills both password inputs, "New admin group" /
  "Custom permissions" reveals the right dependent inputs.
  Pinned to chromium (form-shaped; mobile would just burn CI
  minutes).

- `comment-delete-dispatcher.spec.ts` — `data-action="comment-delete"`
  trigger fires `Actions.BansRemoveComment` with the right
  `cid` / `ctype` / `page`, `confirm()` cancel suppresses the
  API call, and the dispatcher loads globally (the
  `<script src="./scripts/comment-actions.js" defer>` include
  is in `core/footer.tpl`).

- `groupban-dispatcher.spec.ts` — empty URL → inline error +
  no API call, valid URL → chains
  `Actions.BansGroupBan` → `Actions.BansBanMemberOfGroup`,
  `data-action="groupban-select-all"` toggle flips synthetic
  `chkb_<n>` checkboxes.

The group-ban surface ships behind `config.enablegroupbanning`,
which `data.sql` defaults to 0. The spec flips it on in
`beforeAll` and reverts in `afterAll` via a new
`setSettingE2e(key, value)` helper in `fixtures/db.ts` that
shells out to `web/tests/e2e/scripts/set-setting-e2e.php`
(mirror of the `REPLACE INTO sb_settings` shape `BansTest.php`
uses for the same reason).

AGENTS.md updates
-----------------
- Extended the existing `onclick="<Helper>()"` / `onclick="if
  (typeof <Helper> === 'function') …"` anti-pattern bullet to
  cross-reference #1402 and enumerate the cluster (`ProcessMod`,
  `ProcessAddAdmin`, `LoadGeneratePassword`,
  `update_server` / `update_web`, `LoadGroupBan` /
  `ProcessGroupBan` / `CheckGroupBan` / `TickSelectAll`,
  `RemoveComment`, `window.opener.icon(...)`,
  `window.addEvent('domready', …)`).
- Added a new bullet for the MooTools `window.addEvent('domready', …)`
  DOMready idiom (silent no-op every time it surfaced since
  #1123 D1; replace with `document.addEventListener('DOMContentLoaded', …)`
  or drop the wrapper outright when the script tag lands after
  the elements it touches).
- New "Where to find what" rows for:
  - Wiring a `window.opener.<callback>(...)` slot on a parent
    template (the icon / demo / mapimg callback shape).
  - Wiring a comment-delete trash icon (the shared
    `comment-actions.js` dispatcher).
  - Flipping a `:prefix_settings` row from an E2E spec
    (`setSettingE2e` helper + its caller-cleanup contract).

Test plan
---------
- ./sbpp.sh phpstan                                    ✓
- ./sbpp.sh test                                       ✓ (677 tests)
- ./sbpp.sh ts-check                                   ✓
- ./sbpp.sh composer api-contract                      ✓ (no diff)
- ./sbpp.sh e2e --workers=1                            ✓ (279 passed)
- ./sbpp.sh e2e --grep "1402|mods-add|admins-add|comment-delete|LoadGroupBan" --workers=1
                                                       ✓ (12 passed)

Out of scope (deferred per the issue body)
-----------------------------------------
- `admin.admins.php` `$serverscript` blob (sister #1404, parallel
  worktree).
- `admin.groups.php` `LoadServerHostPlayersList` echo (sister
  #1404).
- The remaining `<script>ShowBox(...)</script>` toast blobs on
  lostpassword / protest / banlist / commslist /
  admin.edit.comms (sister #1403).