fix(webui): 修 7 处弹窗关闭错对象 + 模板管理器变量遮蔽

上一提交只修了自己新加的两处弹窗，全站其余 7 处是同一缺陷：所有对话框
共用 id="modal-wrap"（CSS `#modal-wrap:not(:empty){display:flex}`）且可以叠
加（seed-key 提示就盖在密钥页上），而
`const w = $("#modal-wrap"); w.remove()` 移除的是**文档里第一个**，不是用户
刚提交的那一个。

逐处改为两种安全写法：
- 能拿到按钮的（saveSource / saveTemplate / sortScopeSave / scopeSave /
  keyQuotaSave / createKey / downloadStatsCsv / downloadKeysCsv /
  scrAddFromForm）：`btn.closest("#modal-wrap")`
- 拿不到按钮的：新增 `closeTopModal()` 取**最后一个**（用户看到的那个），
  并作为所有 `if (w) w.remove()` 之后的兜底
- 顺带把 sortScopeSave / downloadStatsCsv / downloadKeysCsv / scrAddFromForm
  的签名补上 btn / this 参数 —— 否则 .closest 恒为 null，表单永远不关

同时修一个相邻的既有 bug：`openTemplateModal` 的 `.map((t) => ...)` 用 t 做
循环变量，模板字面量里又调 t("srcEdit")，t 被遮蔽成对象 ⇒ 打开模板管理器
直接抛 `t is not a function`，整个弹窗渲染失败（main 上就有，git show 确认）。
参数改名 tpl。修后模板管理器完整渲染（浏览器实测：DeepSeek / 智谱 / Kimi /
SiliconFlow 各行 + Edit/Delete 按钮文案全部正常，零异常）。

判据从 2 处扩到全量（internal/gateway/ui_quota_contract_test.go，+3 例）：
- 全文档扫描：任何 `.remove()` 配裸 `$("#modal-wrap")` 即失败
- 9 个关闭对话框的处理器必须走 .closest 或 closeTopModal
- closeTopModal 必须取 all.length - 1（首尾颠倒就是原 bug）
- 用 .closest 的处理器，其签名必须真的有 btn 参数 —— 否则查找恒为 null，
  表单永远不关
5/5 变异全被抓：sortScopeSave 去 btn 参数、closeTopModal 取第一个、scopeSave
退回裸选择器、saveSource 退回裸选择器、downloadKeysCsv 删兜底。

浏览器实测（共享 Chromium CDP，真实进程，每处都插入一个「decoy」弹窗
占据文档首位，复现原 bug 的触发条件）：
- scopeSave / keyQuotaSave / scrAddFromForm / saveSource / saveTemplate
  五个处理器：自己的表单关、decoy 保留 ✓
- 零 JS 异常
★ 测试自身踩了两个坑，都不是代码问题：① `document.querySelector(sel) && .click()`
  在 CDP 里求值为 undefined，改成箭头函数；② 编辑模板时没填名字就点保存，
  saveTemplate 因 `if (!nm)` 早退、fetch 零调用 —— 一开始我把这个误读成
  「修复失效」，加 fetch 拦截 + 读 #s-name 的值才定位到是测试数据缺失。
  ⇒ 「点按钮没反应」要先分清是「事件没触发」「请求失败」还是「早退」。

internal/gateway/ui_quota_contract_test.go

@@ -45,6 +45,67 @@ func TestUIDialogClosesItselfNotTheFirstModal(t *testing.T) {
 	}
 }
 
+// TestUIDialogClosuresGoThroughSafePaths pins the rule across the whole
+// document by data flow rather than by pattern: every handler that closes a
+// dialog must do it one of the two safe ways. A handler could contain a
+// correct .closest() and still close the wrong dialog on another path.
+func TestUIDialogClosuresGoThroughSafePaths(t *testing.T) {
+	src := stripJSComments(uiSource(t))
+	for _, fn := range []string{
+		"downloadStatsCsv", "downloadKeysCsv", "saveSource", "saveTemplate",
+		"scrAddFromForm", "sortScopeSave", "scopeSave", "keyQuotaSave", "createKey",
+	} {
+		body, ok := jsFunctionBody(src, fn)
+		if !ok {
+			t.Errorf("%s not found", fn)
+			continue
+		}
+		if !strings.Contains(body, `closest("#modal-wrap")`) && !strings.Contains(body, "closeTopModal()") {
+			t.Errorf("%s closes a dialog with neither .closest nor closeTopModal", fn)
+		}
+	}
+	if !strings.Contains(src, "function closeTopModal(") {
+		t.Error("closeTopModal helper is missing")
+	}
+}
+
+// The helper must pick the LAST dialog (the topmost one the user sees), not the
+// first — that inversion is the whole bug.
+func TestUICloseTopModalTakesTheLast(t *testing.T) {
+	body, ok := jsFunctionBody(uiSource(t), "closeTopModal")
+	if !ok {
+		t.Fatal("closeTopModal not found")
+	}
+	if !strings.Contains(body, "all.length - 1") {
+		t.Errorf("closeTopModal does not take the last dialog:\n\t%s", oneLine(body))
+	}
+}
+
+// Handlers that resolve their dialog from a button must actually receive one:
+// a signature without the parameter means the .closest() silently yields null
+// and the save leaves its form stranded on screen.
+func TestUIDialogHandlersReceiveTheirButton(t *testing.T) {
+	src := stripJSComments(uiSource(t))
+	for _, fn := range []string{
+		"downloadStatsCsv", "saveSource", "scrAddFromForm", "sortScopeSave",
+		"scopeSave", "keyQuotaSave", "createKey",
+	} {
+		body, ok := jsFunctionBody(src, fn)
+		if !ok {
+			t.Errorf("%s not found", fn)
+			continue
+		}
+		if !strings.Contains(body, "closest(\"#modal-wrap\")") {
+			continue // uses closeTopModal only
+		}
+		sig := body[:strings.Index(body, ")")+1]
+		if !strings.Contains(sig, "btn") {
+			t.Errorf("%s uses .closest(\"#modal-wrap\") but its signature %s has no button parameter —\n"+
+				"the lookup would always be null and the form would never close", fn, oneLine(sig))
+		}
+	}
+}
+
 // stripJSComments removes // line comments and /* block */ comments from JS
 // embedded in the UI document. It is deliberately simple (no string/regex
 // awareness beyond skipping quoted spans on the same line): the document is