feat(send): clip web URLs into self-contained EPUBs via Tauri webview (#4241)

Builds the URL-clipping path of the "Send to Readest" feature: paste a
link, the renderer ingests the rendered page, and a self-contained EPUB
lands in the library. No server proxy, no external CDN refs left in the
EPUB once it's saved.

Architecture

- New Rust `clip_url` command spawns a hidden Tauri WebviewWindow at the
  target URL with a real Chrome UA + WebKit fingerprint mask, so TLS-
  fingerprint and JS-challenge walls (Cloudflare, Medium, X, WeChat MP)
  resolve naturally instead of bouncing the server proxy.
- Capture transport is URL-payload navigation to a one-shot
  127.0.0.1:RANDOM_PORT/clip/{token}?d={url-safe-base64} listener.
  Top-level navigation isn't governed by CSP connect-src / form-action /
  WebKit Private Network Access — the four earlier transports
  (fetch, <form>, custom URI scheme, window.name) were each blocked by
  one of those.
- Page-to-EPUB bundler (`assetBundler`) walks <img>/<picture> with
  src → data-src → data-original → data-srcset → srcset fallback so lazy-
  loading sites don't ship a 60px LQIP; fetches assets in parallel with a
  per-asset timeout + per-asset/total caps; failed images degrade to alt-
  text placeholders. A per-site rules table (seeded with WeChat MP) + a
  selector fallback catches articles Readability misextracts. Builder
  prepends the article <h1> + byline so the EPUB has a proper opening.
- Nested EPUB TOC built from h1–h6.

UI surfaces

- "From Web URL" entry in the library Import menu, gated to Tauri; web
  build hides the URL field and points at the browser extension.
- `ImportFromUrlDialog` with auto-height (overrides Dialog's `sm:h-[65%]`
  default) and a dim placeholder for the URL field.
- Clip webview window styled to match Readest's main window — macOS
  decorations + overlay title bar; other desktops decorationless with a
  drop shadow; native background + in-page loading overlay pick up the
  caller's `themeCode.bg`/`fg` so light/dark/eink/custom themes all
  render correctly. Title localised, all five overlay/title strings
  translated across 33 locales.

Notes

- Gates the macOS traffic-light positioner to main/reader-* windows so
  the decorationless clip window no longer null-derefs in
  `position_traffic_lights`.
- Stricter validation across the path: schemes restricted to http/https,
  hex-color parsing rejects malformed values, server endpoint returns
  400 on missing/invalid base64.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/readest-app/src/utils/object.ts

@@ -33,6 +33,22 @@ export const getUploadSignedUrl = async (
   }
 };
 
+export const putObject = async (
+  fileKey: string,
+  body: ArrayBuffer | string,
+  contentType: string,
+  bucketName?: string,
+) => {
+  const storageType = getStorageType();
+  if (storageType === 'r2') {
+    bucketName = bucketName || process.env['R2_BUCKET_NAME'] || '';
+    return await r2Storage.putObject(bucketName, fileKey, body, contentType);
+  } else {
+    bucketName = bucketName || process.env['S3_BUCKET_NAME'] || '';
+    return await s3Storage.putObject(bucketName, fileKey, body, contentType);
+  }
+};
+
 export const deleteObject = async (fileKey: string, bucketName?: string) => {
   const storageType = getStorageType();
   if (storageType === 'r2') {

apps/readest-app/src/utils/r2.ts

@@ -54,6 +54,19 @@ export const r2Storage = {
     ).url.toString();
   },
 
+  putObject: async (
+    bucketName: string,
+    fileKey: string,
+    body: ArrayBuffer | string,
+    contentType: string,
+  ) => {
+    return await r2Storage.getR2Client().fetch(`${r2Storage.getR2Url()}/${bucketName}/${fileKey}`, {
+      method: 'PUT',
+      headers: { 'Content-Type': contentType },
+      body,
+    });
+  },
+
   deleteObject: async (bucketName: string, fileKey: string) => {
     return await r2Storage.getR2Client().fetch(`${r2Storage.getR2Url()}/${bucketName}/${fileKey}`, {
       method: 'DELETE',

apps/readest-app/src/utils/s3.ts

@@ -69,6 +69,21 @@ export const s3Storage = {
     return uploadUrl;
   },
 
+  putObject: async (
+    bucketName: string,
+    fileKey: string,
+    body: ArrayBuffer | string,
+    contentType: string,
+  ) => {
+    const putCommand = new PutObjectCommand({
+      Bucket: bucketName,
+      Key: fileKey,
+      Body: body instanceof ArrayBuffer ? new Uint8Array(body) : body,
+      ContentType: contentType,
+    });
+    return await s3Storage.getClient().send(putCommand);
+  },
+
   deleteObject: async (bucketName: string, fileKey: string) => {
     const deleteCommand = new DeleteObjectCommand({
       Bucket: bucketName,