fix(ui): recover the text that truncate hides - #288

Follow-up sweep after the landing hero. Grepped all 25 `truncate` uses in
`.tsx`, then measured each in a browser rather than trusting the class list —
`truncate` is usually correct, and the landing bug was specific: the hidden
text was needed verbatim and nothing could recover it.

Measured, not assumed. The worst case is not mobile:

  settings store, 1440px   value        267px shown, 519px hidden (66%)
                           description  267px shown, 226px hidden (46%)
  doctor, 375px            migration msg          up to 26px hidden (15%)

The settings row hides two thirds of a realistic connection string on a
desktop monitor, with no `title` and no way to read it without opening the
editor — so the list cannot be scanned for the value you are looking for.

Adds `title` to the cases where the value is arbitrary-length and the row is
the only place it appears: settings value + description, migration messages,
user names + addresses, in-flight upload filenames, and the admin card's url
(its only disambiguator when two tools share a label).

`title` is a partial remedy — it does nothing on touch. It is the right one
here because these are scanning surfaces where the layout should stay a fixed
grid; the full value stays reachable through the row's own detail route, and
the tooltip removes the need to travel for a glance.

Deliberately unchanged:

- `CopyableId` — already correct, and the model for the rest: working copy
  handler, plus `title` and `aria-label` carrying the full value. The landing
  hero had hand-rolled a worse version of this component.
- Permission keys in the role editor — measured 0px clipped across all 19 at
  375px; the longest is 23 characters and the column fits it.
- Sidebar identity, module names, status labels, the branding preview, the
  vendored shadcn sidebar, and the dev-only placeholder fixture: short,
  fixed-vocabulary, decorative, or your own identity.
- Doctor's "run command" block truncates four hardcoded short commands that
  do not clip at any width tested. It has no copy affordance, which is a
  missing feature rather than hidden text, so it is left for its own change.

`Doctor.tsx` is now exactly at the 300-line cap. The next edit there needs a
split, not a shorter comment.

Verified: make lint clean, 2152 passed / 2 skipped, 127 JS passed. The
settings fix re-measured against the same connection string that exposed it —
still clipped by design, now carrying the full text in `title`.

Claude-Session: https://claude.ai/code/session_01JJtbN97VhtDr28Fuy5JKEF

The hi-fi pages rewrite (#303) landed while this sat open, and it moved or
rewrote every surface the sweep touched. Re-applied the fix to where the text
now lives rather than to the conflict text:

  Doctor.tsx migrations block  -> pages/components/doctor/MigrationsCard.tsx
  UploadProgressRows.tsx       -> pages/components/UploadsCard.tsx
  settings Browse.tsx table    -> pages/components/StoreTable.tsx
  users UserRow.tsx            -> rewritten in place as a stretched row link

Admin.tsx merged clean and keeps its `title`.

Two things changed on the way:

- The settings description column no longer exists, so only the value carries
  a `title`. It repeats what is rendered, which keeps a masked secret masked.
- The uploads row now truncates the failure text too, so that gets the same
  treatment; both strings come from the server and are unbounded.

The users row needed more than a moved attribute. Main's `UserRow` is a link
stretched over the whole row by a `before:inset-0` overlay, and the overlay
answers the hover. Measured in Chromium with elementFromPoint: a `title` on
the link is announced over every cell in the row — hovering Last login pops
the member's name — and the `title` on the address line below never fires at
all, because the overlay sits on top of it. Both lines are therefore lifted
back above the overlay with `relative`, which was already the file's own
device for keeping the kebab clickable. The name is wrapped rather than
lifted whole so it stays inside the anchor and still opens the user; the
anchor still clips, ellipsis confirmed at 170px. The one cost is that the
address line is no longer part of the row-wide click target.

Skipped, consistent with the original reasoning: StoreCards and UserCards are
the phone variants of these two tables, and `title` does nothing on touch.

make lint clean, 2973 Python passed, 463 JS passed.

Claude-Session: https://claude.ai/code/session_011URawzYPb8nL2gfGh2yFVn