fix(collections): browser-verification pass over the unified builder/editor

The real-browser sweep (the gotcha classes' native habitat — CSP refusals
fail SILENTLY at build/test time) found four defects, all in the item
3.3/3.4 surfaces:

- Shared builder rows used Alpine attribute expressions that the CSP
  parser rejects outright: backtick template literals in :style, the
  ?. optional chain in :placeholder/x-if, and an if-STATEMENT in a
  @click.outside. Rewritten as string concat plus two component methods
  (fieldIsDays, dismissSuggestions). Until this fix every drawer open
  threw a wall of "CSP Parser Error" console noise and the days-value
  affordance never rendered.
- "2 bookss match": the count noun is interpolated into "<n> <noun>s
  match", so callers must pass the SINGULAR ("book"/"item").
- The rules editor page received its fields/tree payloads from the
  route as already-JSON-encoded strings and wrapped them in JSONArg
  AGAIN — double-encoded, so JSON.parse yields a string and the editor
  loaded with NO vocabulary and NO prefill. The route now emits raw
  JSON into the data attributes (single encode).
- Apply was silently inert: the hook store round-trip used
  window.Alpine?.store (optional-chained, no-op when absent) and the
  Cancel/Apply block sat outside the builder island scope for part of
  the session. Both fixed via the imported Alpine instance and moving
  the buttons inside the island; Apply now PUTs the tree end-to-end
  (verified live: prefill → edit → apply → 201 → reload → membership).

Browser-verified clean (no fixes needed): picker scope tabs + episode
grid (?scope=episodes door), selection store across swaps, Add Selected
episode membership, library-switcher partial contract (episodes visible
under All Libraries, correctly filtered out under a book library — and
now never OFFERED as a switcher option), episode cards + reorder arrows
persisting position, collection-chain player (Ep N/M, prev/next carry
?queue=collection:, order control absent in collection mode and present
+ persistent in feed mode both in player and feed page), and the
empty-tree Apply guard (400 — a static collection can never be
promoted by accident).

Notes for the next reader of these lines: the OpenChamber panel's
browser.select sets select.value without dispatching change, so htmx
change-triggers must be exercised by real events (Playwright) rather
than the panel; and one 500 was observed on the player's leave-page
progress PUT — a request whose context the navigating browser cancels
mid-write, pre-existing and benign (the immediately following save
returned 200).

web/src/collection-rules.ts

@@ -16,8 +16,11 @@ function initCollectionRules(id: string, _scope: string, _treeJSON: string): voi
   collectionId = id;
 
   // The builder island emits its APPLY wire through this hook — the
-  // page (not the shared component) owns the collection write.
-  window.Alpine?.store("collectionTreeApply", {
+  // page (not the shared component) owns the collection write. The
+  // IMPORTED Alpine instance owns the store registry (the bookPicker
+  // pattern); window.Alpine is optional-chained elsewhere and may be
+  // absent at init timing.
+  Alpine.store("collectionTreeApply", {
     hook: async (wire: string) => {
       const token = localStorage.getItem("token");
       if (!token) {

web/src/filter_builder.ts

@@ -393,10 +393,10 @@ function filterBuilderData() {
     // applyCollectionTree delegates to the page-registered hook (the
     // collection editor PUTs the tree; All-Books never sets one).
     applyCollectionTree(): void {
-      const hook = (
-        window.Alpine?.store("collectionTreeApply") as { hook?: (wire: string) => void } | undefined
-      )?.hook;
-      if (hook) hook(this.treeJSON());
+      const store = Alpine.store("collectionTreeApply") as
+        | { hook?: (wire: string) => void }
+        | undefined;
+      if (store?.hook) store.hook(this.treeJSON());
     },
     // Rule tree (source of truth; hidden wire inputs are synced after
     // every mutation).
@@ -426,6 +426,20 @@ function filterBuilderData() {
     fieldMeta(key: string): FieldMeta | undefined {
       return FIELD_BY_KEY.get(key);
     },
+    // CSP-safe accessor: attribute expressions cannot use optional
+    // chaining (the CSP parser rejects `?.`), so the null-walk lives
+    // here.
+    fieldIsDays(key: string): boolean {
+      return this.fieldMeta(key)?.valueKind === "days";
+    },
+    // CSP-safe click-outside for the value menu (attribute expressions
+    // cannot carry if-statements).
+    dismissSuggestions(e: Event): void {
+      const target = e.target as HTMLElement | null;
+      if (!target || !target.closest(".fb-value-cell")) {
+        this.suggestionsOpen = "";
+      }
+    },
     fieldLabelOf(key: string): string {
       return FIELD_BY_KEY.get(key)?.label ?? "Field";
     },