feat(dashboard): copyable 'connect CLI' command in API-key-created popup + fix X close

[dvcdsys]

What

Two dashboard changes to the "API key created" popup
(server/dashboard/src/modules/api-keys/components/CreateApiKeyDialog.tsx):

1. New feature — after a key is created, the popup now shows a copyable,
   ready-to-paste command that registers this server (URL + the freshly
   minted key, as a single server.<alias> entry) in the cix CLI and makes it
   the default:

   cix config set server.<alias>.url <origin> && \
     cix config set server.<alias>.key <key> && \
     cix config set default_server <alias>
   

   Flow: create key → copy command → paste in terminal → cix search "…" works.

2. Bug fix — the popup's top-right X button now actually closes the
   dialog. Previously, while a key was revealed it could only be dismissed by
   reloading the page.

Why

• Feature: removes the manual, error-prone step of hand-assembling the CLI
  config after minting a key. The API key belongs to the server it was created
  on, so the command writes both into one server entry — no guessing the URL,
  no separate "set the key" step.
• Fix: the reveal screen was effectively un-closable except by reloading,
  which is confusing and looks broken.

How

• Server URL: the dashboard is served same-origin from cix-server, so
  window.location.origin is exactly the base URL the CLI must talk to — no new
  endpoint or server/CLI change needed.
• Alias: derived from window.location.host and folded to [a-z0-9-]
  (cix.example.com → cix-example-com, localhost:21847 → localhost-21847).
  The CLI parses server.<alias>.url by splitting on dots, so the alias must be
  dot-free — cixServerAlias() guarantees that.
• Copy: reuses the existing secure-context navigator.clipboard path with a
  document.execCommand fallback for plain-HTTP deploys (extracted into a shared
  copyText() helper; separate "copied" state for the key vs. the command).
• X-close fix: removed the if (!next && revealed) return; guard in
  onOpenChange that swallowed every close while a key was revealed. Accidental
  dismissal (Escape / outside-click) stays blocked at the DialogContent layer
  via preventDefault, so only the explicit X (and "I've saved it") close — and
  both now reset state.
• Scope: frontend-only, one file. No CLI command, Go server, OpenAPI, or
  auth change. Built dist/ is gitignored (CI builds it), so no bundle is
  committed.

Type of change

• Bug fix
• New feature

Checklist

• npm run typecheck (tsc) passes
• npm run build (vite) passes
• No secrets or API keys committed (the key is generated at runtime from full_key)
• Tested against a running API server — pending manual browser verification

🤖 Generated with Claude Code