feat(inventory): SkinCraft 3D viewer embed

[ykns3]

Summary

Adds a View in 3D action to Steam inventory items, opening the SkinCraft viewer in a modal over the page. The viewer is a persistent, sandboxed cross-origin iframe driven entirely over postMessage — the extension never re-srcs it, so switching items inside the modal is instant once warm.

How it works

• gSkinCraftEmbed is the single source of truth for the boot/load lifecycle: a versioned protocol (origin-pinned in both directions, never '*'), load correlation ids so stale progress/loaded/error events can't clobber a newer load, a 20s load timeout, and pause/resume on tab visibility.
• Two worlds. The page-world instance reads g_ActiveInventory and posts the clicked item plus a bounded inventory snapshot to the content-script instance, which owns the iframe. The iframe deliberately stays out of the page world, so Steam's own scripts can't reach it, its message channel, or its closed shadow root.
• Item identity is the masked inspect hex from asset_properties[propertyid=6] — SkinCraft resolves it client-side, so there's no Steam GC round-trip and no dependency on a float fetch.
• SkinCraftViewerModal owns one <dialog> created once and never unmounted, since unmounting would reload the embed. It renders with lit-html's render() rather than extending FloatElement: the content script builds it, and Chrome leaves customElements null in isolated worlds, so no custom element can be defined there.
• Inventory strip inside the modal for moving between loaded skins without closing it, with seed/float badges from the existing float cache and card colours from Steam's own rarity/background tags. Wrapped in guard() so load-progress ticks don't re-diff every card.
• WebGPU gating (webgpu_availability.ts): adapter-only probe, so the button renders only where the viewer can actually run. Three-state and pessimistic while probing, so it never appears and then fails.
• Keyboard focus is handed to the iframe on open and on every inventory-strip selection, since the embed's hotkeys listen inside its own document.

Sandbox / security

sandbox="allow-scripts allow-same-origin allow-downloads", allow="fullscreen", referrerpolicy="no-referrer". Inbound messages are gated on event.origin and shape-validated at both boundaries (skincraft_embed_protocol.ts, skincraft_viewer_protocol.ts); outbound is pinned to the embed origin. The inventory snapshot is length-bounded and every field is checked before it crosses.

Behaviour notes

• The 3D button also appears on other users' inventories — viewing is deliberately independent of listing eligibility, unlike List on CSFloat.
• List on CSFloat now sits in a flex row alongside the new button. That's the only part of this PR that changes existing UI rather than adding to it.
• Clients without a WebGPU adapter see no button at all. navigator.gpu isn't Baseline — absent before Firefox 141, platform-dependent after — against a strict_min_version of 127.

Dev notes

• Local dev points skincraft_embed_origin at a local SkinCraft dev server. The prod embed allowlist has no localhost entries, and steamcommunity.com still needs adding as an allowed ancestor before this works outside dev — that SkinCraft deploy ships alongside this. Without either, the modal shows its error state; nothing else is affected.
• If the dev origin serves a self-signed cert, visit it top-level once and accept it first: Chrome refuses an untrusted-cert iframe silently, with no interstitial.

Rollout & testing

• Local runs of the CI gates are green: npm run build, npm run checkformat, npm test (30 tests / 5 files), plus tsc --noEmit and madge --circular (345 files, no cycles). Node 24, matching CI.
• Tests cover the two protocol validators, progress clamping/monotonicity, and inventory extraction. The modal is verified by hand.
• Merges cleanly into current master (branch base is master@f882f20, unchanged).

---

Note

Medium Risk
Cross-origin iframe messaging and sandbox boundaries are security-sensitive, but origins and payloads are validated; main rollout risk is dependency on SkinCraft embed allowlisting and WebGPU availability on user browsers.

Overview
Adds a View in 3D flow on Steam inventory item details that opens SkinCraft in an in-page modal, gated on WebGPU and valid masked inspect hex from Steam asset properties (no float fetch required to open).

skincraft_embed_origin is added to all environment configs. gSkinCraftEmbed owns a long-lived sandboxed iframe and a versioned, origin-pinned postMessage protocol (load ids, 20s timeout, pause/resume on tab hide). The page world posts an open message plus a bounded inventory snapshot; the content script hosts the modal and iframe so Steam page scripts cannot reach the embed.

SkinCraftViewerModal is lit-html (not a custom element) with a closed shadow root, persistent iframe src, loading/error UI, and an optional inventory strip (seed/float from float cache, rarity styling). selected_item_info shows the new button beside refactored List on CSFloat in a flex row; listing rules are unchanged but extracted into canListOnCSFloat. float_fetcher.getCached supports inventory card metadata.

Tests cover embed and viewer message validation, progress handling, and inventory target extraction.

^{Reviewed by Cursor Bugbot for commit 0afeb89. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 587fd98. Configure here.}