feat(clipboard): make clipboard restore delay configurable

[missuo]

Closes #109

Summary

Adds a global, file-based clipboard.restore_delay_ms setting to config.yaml controlling how long Koe waits after an automatic paste completion callback before restoring the pre-session clipboard contents. Default 1500 ms (unchanged behavior), inclusive range 0–60000; 0 schedules restoration immediately after the paste completes (it does not disable restoration).

Changes

Rust (koe-core)

• New ClipboardSection in the typed config model with tolerant deserialization: a negative, non-integer, overflowing, or >60000 value emits a warning (never containing clipboard contents) and falls back only this field to 1500, preserving all unrelated ASR/LLM/hotkey configuration. Custom serde visitors are required because serde_yaml hard-errors on integers wider than u64 otherwise.
• sp_core_get_clipboard_config() exposes the validated, cached value across the FFI boundary (mirrors sp_core_get_feedback_config); the native layer never rereads raw YAML at paste time.
• Default config template documents the setting, range, zero semantics, and fallback behavior.

Native (KoeApp)

• New SPClipboardRestorePolicy: snapshots the effective delay once per voice-input session (right after session_begin, which is also where Rust hot-reloads config — so edits during an active session apply from the next session) and serves as the single restoration entry point for both automatic paste flows.
• Both literal 1500 call sites (normal final-text flow and experimental ASR-first flow) now go through the policy. Clipboard-only delivery (missing Accessibility permission, prompt-template rewrites, unsafe in-place correction fallback) still never schedules restoration.
• Existing safety mechanics are untouched: pasteboard change-count check, restore-generation supersession, earliest-backup preservation.

Docs: DESIGN.md §20.13 + hardcoded-timing note updated; CHANGELOG.md unreleased entry added.

Tests

• Rust config seam: absent section/field, 0 / 1500 / 60000 accepted; negative, float, string, bool, sequence, >60000, and u64-overflowing values fall back to 1500; invalid clipboard values preserve unrelated asr/llm fields; malformed section shapes tolerated. cargo test -p koe-core --lib: 88 passed.
• Native policy seam: recording clipboard-manager test double verifies the session snapshot value is what gets scheduled, zero-delay is scheduled (not skipped), a newer session snapshot supersedes the previous one, and capturing a policy schedules nothing by itself. KoeLogicTests: 25 passed.
• Full app target builds (xcodebuild -scheme Koe), cargo check --workspace clean, rustfmt applied, no new clippy warnings.

🤖 Generated with Claude Code