feat: heap row kebab menu with rename + duplicate

The heap row used to fan out three small icon buttons (set active, convert
to folder, delete) on hover, which crowded the row and didn't leave room
for new actions. Collapse the destructive / occasional ones into a kebab
menu and add the missing operations.

- Right-aligned action cluster: active indicator → count badge → target
  toggle (when not active) → kebab menu, all flex-shrink-0 so the name
  truncates first.
- Kebab menu items: Rename, Duplicate, Move to folder…, Delete. Outside
  click and Escape close the popover; the trigger has aria-haspopup +
  aria-expanded. Delete still confirms via window.confirm.
- Inline rename: double-click a heap row OR pick Rename from the menu
  to edit the name in place. Enter commits, Escape cancels. Mirrors the
  folder rename pattern in LeftSidebar.
- backend: new POST /heaps/{id}/duplicate creates a copy with the same
  membership ("{name} (copy)") via INSERT...SELECT on heap_photos.
  Never marks the new heap as active so duplicating doesn't quietly
  steal the user's T-key destination.
- api.ts: heaps.duplicate wrapper.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/routers/heaps.py

@@ -137,6 +137,46 @@ async def update_heap(
     }
 
 
+@router.post("/{heap_id}/duplicate", status_code=201)
+async def duplicate_heap(heap_id: str, db: AsyncSession = Depends(get_db)):
+    """Create a new heap with the same membership as an existing one. The
+    new heap is named "{original} (copy)" and is never the active target —
+    duplicating shouldn't quietly steal the user's T-key destination.
+    """
+    result = await db.execute(select(Heap).where(Heap.id == heap_id))
+    source = result.scalar_one_or_none()
+    if not source:
+        raise HTTPException(status_code=404, detail="Heap not found")
+
+    new_heap = Heap(name=f"{source.name} (copy)", is_active=False)
+    db.add(new_heap)
+    await db.flush()  # populate new_heap.id without committing yet
+
+    # Bulk-copy the membership rows. SELECT photo_id FROM heap_photos WHERE
+    # heap_id = :src — INSERT each into the new heap. Done as a single
+    # INSERT...SELECT to avoid round-tripping ids through Python.
+    member_rows = await db.execute(
+        select(heap_photos.c.photo_id).where(heap_photos.c.heap_id == heap_id)
+    )
+    photo_ids = [row[0] for row in member_rows.all()]
+    if photo_ids:
+        await db.execute(
+            insert(heap_photos),
+            [{"heap_id": new_heap.id, "photo_id": pid} for pid in photo_ids],
+        )
+
+    await db.commit()
+    await db.refresh(new_heap)
+    return {
+        "id": new_heap.id,
+        "name": new_heap.name,
+        "is_active": False,
+        "photo_count": len(photo_ids),
+        "created_at": new_heap.created_at,
+        "updated_at": new_heap.updated_at,
+    }
+
+
 @router.delete("/{heap_id}", status_code=204)
 async def delete_heap(heap_id: str, db: AsyncSession = Depends(get_db)):
     """Delete a heap. Photos themselves are unaffected — only the membership