fix(ui): finish contextual help and keyboard tooltips

[krisarmstrong]

Summary

Finish page-specific help and keyboard tooltips throughout Stem. Header and sidebar Help now open the current route's test or glossary topic, restore keyboard focus, and close when browser history changes. Short help text is translated in English and Spanish; test details link to real standards and related tests, and glossary search reveals matching entries.

Unavailable actions expose their explanation on focus without executing or submitting. Enabled Help actions dismiss their tooltip after focusing the opener, so Escape closes the drawer reliably in WebKit. The local build also computes its embedded-UI hash after the frontend build instead of embedding the previous assets' hash.

Linked Issue

Fixes #1259
Fixes #1278
Fixes #1279
Fixes #1280
Fixes #1281
Fixes #1287

Type of Change

• Defect fix
• CI / release / packaging

Risk

• Medium

The tooltip conversion touches many form controls. Disabled-action mouse, Enter, Space and form-submission behavior is covered in a real Chromium story; page help is covered in Chromium and WebKit. Long technical guides remain in English according to the existing plan. No backend authorization policy or dependency changed.

Testing Evidence

npm --prefix ui test
Test Files 62 passed (62)
Tests 557 passed (557)

npm --prefix ui run test:storybook:run
Test Files 39 passed (39)
Tests 111 passed (111)

scripts/run-e2e.sh e2e/help-context.spec.ts e2e/help-drawer-smoke.spec.ts e2e/help-drawer.spec.ts --workers=2
24 passed (1.7m); skipped 0; unexpected 0; flaky 0

/__version uiBuildHash: 599588b1ac98e97e81358907dbebdc27
Independently calculated embedded-asset hash: 599588b1ac98e97e81358907dbebdc27

• make test: all 32 Go packages and frontend test files passed; Go coverage 78.6%.
• npm --prefix ui test: final full frontend suite557/557 passed in62files.
• npm --prefix ui run test:storybook:run: 111/111 browser component tests passed.
• E2E_SKIP_BUILD=1 scripts/run-e2e.sh e2e/help-context.spec.ts e2e/help-drawer-smoke.spec.ts e2e/help-drawer.spec.ts --workers=2: 24/24 passed, no retries or skips, against the built HTTPS daemon. English/Spanish, 390px/1440px, route topics, back/forward, trailing slashes, focus restoration and hover Escape.
• make build: frontend and backend passed. Both browser engines read /__version; its nonempty UI hash matched a separately calculated hash of the embedded assets.
• make lint, make fmt-check, npm --prefix ui run typecheck: no source lint/type/format violations. Existing golangci-lint unused-exclusion configuration warnings remain.
• make security: no Go vulnerabilities, npm vulnerabilities or secrets.
• node --test scripts/check-help-i18n.test.ts and node scripts/check-help-i18n.ts: five fixtures and production consumer check passed. Shared scripts/i18n/validate.sh passed; its existing notice about absent general extraction scripts remains. CI runs the concrete help consumer gate separately.
• File-size, vocabulary, actionlint and high-severity workflow-security gates passed.

Native Linux ARM64 validation in an Apple container on this Mac: C dataplane compilation, all five go test ./internal/api/... -count=1 -timeout=180s packages, and CGO backend compilation passed as UID1000. Host-folder mounts failed with a virtualization error; sending a source archive over stdin allowed the isolated container to run. A separate root execution reproduced the existing reflector privilege-drop defect#1231 and is explicitly not a pass. This work does not claim real-packet or lab acceptance; hosted release packaging remains authoritative.

Focused tooltip regressions: ./scripts/run-e2e.sh e2e/reflector-platform-guard.spec.ts e2e/rfc2544-subtest-selection.spec.ts --retries=0 --workers=2 rebuilt the embedded UI and daemon, then passed all 8 tests on Chromium and WebKit. The tests assert disabled controls expose an accessible tooltip, Escape dismisses the tooltip before the drawer, and the selected RFC 2544 request payload remains unchanged. Biome passed both changed test files.

Security and Release Checklist

• No secrets, tokens, credentials, or customer data are included.
• Mutating routes, auth surfaces, permission checks, and output encoding were reviewed if touched.
• Dependencies are pinned and justified if changed.
• Documentation, screenshots, or operator notes were updated if behavior changed.