Add debug copy button and functionality

Includes a button for administrators to copy all transcripts and the
document markdown to the clipboard.
The data is embedded as JSON in a script tag and pre-sanitized to
prevent
`</script>` tag injection.
The JavaScript handles copying to the clipboard using the modern
Clipboard API,
with a fallback for older browsers.

server/src/routes/user_web.rs

@@ -346,6 +346,12 @@ struct CasePageTemplate {
     /// Session CSRF token — rendered as a hidden field into every
     /// state-changing form on the page (close/reopen/analyze/reset/logout).
     csrf_token: String,
+    /// Admin-only debug copy bundle, pre-serialised as JSON for inline
+    /// embedding into a `<script type="application/json">` block. Shape:
+    /// `{"transcripts":["..."],"document":"..."|null}`. Empty string when
+    /// `is_admin` is false (template skips the block in that case anyway).
+    /// Pre-sanitised against `</script>` breakout via `<\/` substitution.
+    debug_copy_json: String,
 }
 
 #[derive(Template)]
@@ -631,9 +637,12 @@ pub async fn handle_case_page(
     // Read document first; if it's on disk we display it regardless of what
     // the `analyzing` flag would otherwise say. Resolves the narrow race
     // where the worker finishes between flag check and template render.
-    let document_html = read_document(&case_dir)
-        .await
-        .map(|md| crate::analyze::render::md_to_html(&md));
+    // Keep the raw markdown around for the admin debug-copy bundle so we
+    // don't pay a second filesystem read.
+    let document_md = read_document(&case_dir).await;
+    let document_html = document_md
+        .as_deref()
+        .map(crate::analyze::render::md_to_html);
 
     let recordings = scan_recordings(&case_dir).await;
     let (oneliner, oneliner_is_manual) = compute_oneliner_display(&case_dir, &recordings).await;
@@ -658,6 +667,27 @@ pub async fn handle_case_page(
 
     let is_closed = crate::paths::is_closed(&case_dir).await;
 
+    // Admin debug-copy payload — only built when the viewer is an admin
+    // so non-admin renders skip the JSON serialisation entirely.
+    let debug_copy_json = if is_admin {
+        let transcripts: Vec<&str> = recordings
+            .iter()
+            .filter_map(|r| r.transcript.as_content())
+            .collect();
+        let payload = serde_json::json!({
+            "transcripts": transcripts,
+            "document": document_md,
+        });
+        // `</` breaks out of a `<script>` element; the inline JSON block
+        // would otherwise be vulnerable if a transcript or the document
+        // ever contained a literal `</script>`.
+        serde_json::to_string(&payload)
+            .unwrap_or_else(|_| "{}".to_owned())
+            .replace("</", "<\\/")
+    } else {
+        String::new()
+    };
+
     CasePageTemplate {
         case_id: case_id_str,
         case_id_short,
@@ -676,6 +706,7 @@ pub async fn handle_case_page(
         is_admin,
         is_closed,
         csrf_token: user.csrf_token,
+        debug_copy_json,
     }
     .render()
     .map(Html)