Fix audit tabs blocked by the Export dropdown (upstream #223)

[jackwalkerlabs]

Opening Export on a completed audit could prevent a single click from selecting Issues, Pages, or Performance. The shared export menu now uses explicit open state and dismisses on outside interaction without consuming the target click. It retains export actions and adds semantic button/menu roles, Escape focus restoration, and keyboard navigation.

Closes #8. Upstream: every-app#223.

The regression now opens the actual completed-audit route with explicit E2E fixtures and checks all three tabs, CSV export, Escape, and outside dismissal. Fixture data is enabled through VITE_E2E_AUDIT_FIXTURES, following existing repository test configuration.

Validation for candidate f19dde999a7937222705e0e4eb4d132dc4331a68:

• Worker full unit suite: 138 files / 1,165 tests passed; lint, formatting, and diff checks passed.
• Playwright test discovery succeeded (one focused scenario). Browser execution failed during Vite startup while parsing a non-JSON response, before Chromium launched. No browser pass is claimed.
• Full TypeScript checks exceeded the worker memory limit. Focused lint success is not a full typecheck.
• Normal candidate review approved after one repair pass replaced the unrelated Domain Overview scenario with audit-route coverage.

Independent verification on the same exact head passed at 2026-09-07 02:28:29Z: fresh pnpm@10.30.1 install --offline --frozen-lockfile (86.873 seconds), then pnpm@10.30.1 run test; 138 files / 1,165 tests passed in 99.82 seconds, exit 0, networking disabled and no credentials. Solo reused the approved in-run review for this unchanged head.

Run: FC-20260907-F566B9, Codex gpt-5.6-sol. Human review and normal merge gates still apply.

Reviewer QA: run the focused audit-results-export Playwright scenario in a working repository E2E environment. Also open a completed audit manually, open Export, and click each results tab once; each click should both dismiss the menu and select its tab. Confirm CSV/JSON exports, Escape with trigger focus restoration, arrow-key navigation, and outside dismissal. This frontend change has not been deployed.

Upstream follow-up: draft every-app/open-seo#301, head f8b6dce2ed428dcc3773a30d58dc45820d397c2c, includes the missing ImportMetaEnv fixture-flag declaration caught by a full local TypeScript check. That new head passes full TypeScript and all 1,165 unit tests. It uses a separate branch; this fork PR retains the original Solo-verified head. Browser QA remains pending the local CUA existing-profile grant. Upstream currently permits reference PRs but does not merge external PRs.