feat(desktop): show full URL tooltip on masked link hover

[AaronGoldsmith]

Summary

Masked links — [text](url) where the visible text hides the destination — now
show a tooltip with the full URL on hover, mirroring Slack's anti-phishing
affordance. The reader can see where a "click here" link actually goes before
clicking. Bare pasted URLs and GFM autolinks are unchanged: their label already
is the destination, so a tooltip would be redundant.

Motivation

A message like [the quarterly report](https://intranet.example.com/…) renders
only the label. Without hovering, there's no way to tell a legitimate link from
a lookalike ([accounts.google.com](https://evil.example)). Slack added exactly
this hover-to-reveal behavior; this brings desktop Buzz to parity.

Scope

Deliberately narrow for a first version:

• Masked links only. If the label already matches the destination
  (modulo cosmetics), no tooltip.
• Desktop only. Web and mobile (which would need a long-press affordance)
  are out of scope.
• Plain external links only. Message-link pills, file cards, buzz://
  deep links, and Linear-styled links keep their existing hover treatments.

How it works

• isMaskedLink(label, href) (desktop/src/shared/lib/maskedLink.ts) parses
  both sides with the URL API and compares component-wise. Cosmetic
  differences stay tooltip-free (omitted scheme, trailing slash, host case)
  while spoof shapes always trigger.
• The tooltip wrap lives in its own module
  (desktop/src/shared/ui/markdown/MaskedLinkTooltip.tsx) — markdown.tsx is
  at its file-size ceiling. It reuses the existing Radix tooltip primitive and
  the app-global TooltipProvider.
• Tooltip content is pointer-events-none (never intercepts a click meant for
  the link or a spoiler wrapping it) and never truncates (max-w-md +
  overflow-wrap:anywhere) so the full destination stays auditable — most URLs
  fit on one line, long ones wrap at natural boundaries instead of mid-word.

Adversarial review

The first predicate draft used naive string normalization (scheme-stripping +
whole-URL lowercasing). An adversarial review pass (codex + gemini) found
spoofable false negatives, all now covered by tests:

Spoof	Before	Now
Scheme downgrade [https://x](http://x)	missed	masked
Case-only path/query change	missed	masked
Protocol-relative //host/… href	bypassed	masked
Userinfo label safe.com@evil.com	missed	masked

Also included

A second, separate commit fixes a pre-existing flaky e2e test
(spoiler.spec.ts) surfaced while validating this change: click({force:true})
computed its target from the link's bounding box while the freshly sent row was
still settling layout, so the click occasionally landed a few px off on the
author name (~1 in 3 cold runs, reproducible on main). Now waits for the
link's position to be stable across two animation frames before clicking.

Testing

• just ci green (fmt, clippy, desktop lint, unit tests, mobile tests, builds).
• 12 table-driven tests for isMaskedLink covering every spoof case above.
• Playwright: full spoiler + link specs pass, including 4/4 cold-start runs of
  the previously flaky test.
• Manually verified in the running app: masked links reveal the URL, bare links
  don't, and the documented spoof cases all trigger.

Not in scope

• Web / mobile equivalents.
• Tooltips on pills, file cards, Linear links, buzz:// anchors.
• A separate, pre-existing link-resolution bug: scheme-less link targets
  ([docs](example.com/x)) render as relative URLs and resolve against the app
  origin. Independent of this change; tracked separately.

[AaronGoldsmith]

Masked link — URL revealed on hover

A [the quarterly report](https://intranet.example.com/…) link. Hovering shows
the full destination on a single line; the tooltip floats above the message.

Bare link — no tooltip

A pasted https://example.com/plain-url. No tooltip, since the visible text
already is the destination.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6bf9b0d449

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Suppress masked-link tooltips inside hidden spoilers

When the masked link is inside an unrevealed spoiler, this wrapper still installs a Radix tooltip trigger on the hidden anchor. The spoiler CSS only makes .buzz-spoiler__content transparent; it does not disable pointer/focus events, and the tooltip content is portaled outside the spoiler, so hovering or tab-focusing ||[secret](https://private.example/path)|| reveals the URL before the spoiler is opened. Please disable the tooltip while the trigger is within .buzz-spoiler[data-revealed="false"] or otherwise prevent hidden spoiler descendants from opening it.

Useful? React with 👍 / 👎.

[AaronGoldsmith]

Fixed in ea27128.

SpoilerInline now provides a SpoilerHiddenContext (true while unrevealed, and always true for inert preview spoilers); MaskedLinkTooltip consumes it and renders the plain anchor with no Radix trigger while hidden, so neither hover nor focus can open the tooltip. It re-enables reactively when the spoiler is revealed.

Added an e2e regression in spoiler.spec.ts asserting the URL tooltip stays closed on both hover and focus of a masked link inside a hidden spoiler, then appears normally after reveal. The focus vector was the reproducible leak (the particles overlay intercepts the pointer, but focus bypasses it).

[wesbillman]

Thank you!