fix(audit): keep results tabs clickable while Export is open

[jackwalkerlabs]

Opening Export on a completed audit can prevent a single click from switching Issues, Pages, or Performance. This changes the shared menu to explicit open state so the outside click dismisses it and reaches the selected tab. Export actions, Escape/focus restoration, and keyboard navigation remain available.

Proof of concept for #223, following the contribution guide's allowance for reference PRs. Prepared with Codex.

The regression uses the actual completed-audit route with opt-in fixture data, dismisses the first-run setup dialog, and checks all three tabs, CSV download, Escape/focus restoration, and outside dismissal. The fixture flag is declared in ImportMetaEnv and enabled by the existing Playwright setup.

Validation on exact head df0a342f5fce5f8cbd9ce6a31937d0ea7923a8f4:

• FactoryChief Linux verification passed: full TypeScript and 138 files / 1,165 unit tests, after a fresh frozen offline pnpm install in a credential-free, network-none verifier. Unit suite: 110.09s.
• FactoryChief browser validation passed: 1/1 Playwright scenario, zero retries, 21.1s. Confirmed one-click Pages → Performance → Issues switching with Export open, CSV download, Escape returning focus to Export, and outside-heading dismissal. Trace retained.
• These were isolated operator invocations of the shipped DockerRunner.verify and DockerRunner.runValidation on Solo (runtime 8b9680d7, validation ID FC-20260907-F0BDD6), with a separate validation database; this is not a new production-dashboard run. The committed test was unchanged. A runner adapter used system Chromium, Factory-managed Vite startup, and Playwright-to-Factory reporting.
• Local D1 migrations and fixture-only local_noauth setup were used; no paid-provider credentials or requests. The PR worktree remained clean at the validated SHA.
• Focused type-aware lint, formatting, and whitespace checks also passed locally.

An earlier macOS existing-profile Chrome/CUA attempt crashed during mouse tab navigation with both the original UI and this change. That crash remains unexplained; the full requested interaction scenario now passes in Factory's Linux browser environment. No production deployment or complete repository-wide E2E-suite pass is claimed.