Address PR #251 review feedback: fix imports, memory leaks, accessibility, and add tests

[Copilot]

Addresses 6 review comments from PR #251 focusing on correctness (import paths, memory management), performance (asset pipeline), and accessibility (keyboard navigation).

Import Path Fix

• DoorBlocking.test.ts: Corrected relative imports ../types/* → ../../types/* to resolve to src/types/

Memory Leak Prevention

• useCanvasDrop: Revoke existing object URL before creating new one when multiple files are dropped while crop is pending
• useCanvasDrop: Revoke object URL on both confirm and cancel paths

Asset Pipeline Integration

Replaced base64 conversion with asset processing pipeline for cropped images:

// Before: base64 string (33% overhead, in-memory)
const reader = new FileReader();
reader.readAsDataURL(blob);
reader.onloadend = () => {
  addToken({ src: reader.result as string, ... });
};

// After: WebP + temp storage
const file = new File([blob], `token-${Date.now()}.png`, { type: blob.type });
const handle = processImage(file, 'TOKEN');
const processedSrc = await handle.promise;
addToken({ src: processedSrc.replace('file:', 'media:'), ... });

Reduces memory usage, store size, and IPC sync payload.

Accessibility Improvements

• CommandPalette: Added tabIndex={0} + aria-activedescendant pattern for keyboard navigation
• CanvasAccessibility: Blocked arrow key token movement in World View to prevent unsynced edits

Test Coverage

Added useCanvasDrop.test.ts with 12 tests covering:

• Drop behavior (library tokens, generic tokens, file drops)
• Object URL lifecycle (creation, revocation, memory leak scenarios)
• Asset pipeline integration and error handling
• Cancel/cleanup paths

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• collector-prod.1am6wm210aow.us-south.codeengine.appdomain.cloud
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/Graphium/Graphium/node_modules/@ibm/telemetry-js/dist/REDACTED-process.js --log=/tmp/ibmtelemetry-20260210T202049341Z-332188.log --config=telemetry.yml (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)