feat: copy/paste per-class auto-annotate overrides as YAML (REQ-186, REQ-190)

Copy now emits YAML instead of the one-line "class <name> conf ..." text: one
block per selected class, fields named after the row labels, globals resolved
into the block, a name quoted only when YAML would misread it.

Paste reads the clipboard back and fills the overrides for the classes selected
in that modal, naming any it ignored — an override for a deselected class would
otherwise ride along in class_params unseen. container diffs go out as one
PATCH /projects/{id} and revert together if the save is rejected.

Parsing is parseClassYaml, a strict subset reader for exactly what Copy emits,
so no YAML dependency: any malformed line throws with its line number and
applies nothing. Values must look like numbers, not merely start like them —
parseFloat would have taken "0.5abc" as 0.5.

Both are real buttons with Lucide icons plus a status line reporting the
outcome, and both live in the shared table so the mass modal carries them too.

docs/requirements.md

@@ -141,14 +141,17 @@ changes.
   returns that class to its full-set detections, so clearing them all is a plain full-set view
   again. The preview and the batch job still use the same thresholds and per-class overrides.
 - **REQ-186** — The auto-annotate parameters table has a **copy button** that puts every
-  selected class's effective settings on the clipboard as short text, one class per line:
-  `class <name> conf <v> iou <v> minbox <v> maxbox <v> container <true|false>`. Effective
-  means the per-class override where one is set, otherwise the global slider value;
+  selected class's effective settings on the clipboard as **YAML**, one class per block:
+  `"<name>:"` at the left margin then the five fields `conf`, `iou`, `minbox`, `maxbox` (the
+  labels as written on screen) and `container: <true|false>`, each on its own indented line,
+  preceded by a `#` comment line. A class name is quoted only when YAML would misread it.
+  Effective means the per-class override where one is set, otherwise the global slider value;
   `container` is the class's current checkbox state. The button sits in the shared
   per-class table, so it exists in both the per-batch auto-annotate modal and the mass
-  (batches tab) modal, and the copied text is a plain baseline for later tuning — no
-  structure beyond the line format. Copying needs no network round-trip and never changes
-  any setting. (Amended by REQ-188: `maxbox` added to the line.)
+  (batches tab) modal, and the copied YAML is a plain baseline for later tuning. Copying needs
+  no network round-trip and never changes any setting. (Amended by REQ-188: `maxbox` added to
+  the block. Amended by REQ-190: the wire format is YAML instead of the old one-line
+  `class <name> conf <v> …` text, and a **Paste** button round-trips it.)
 
 - **REQ-188** — Auto-annotation accepts a per-class **maximum box fraction**
   (`max_box_frac`, default `1.0` = off) beside the existing minimum override of REQ-181:
@@ -157,6 +160,22 @@ changes.
   review assist filter), surfaces as `MaxBox` in the params table, and is included in the
   REQ-186 copy line. Size bounds are ordinary per-class tuning: the `container` flag
   (REQ-184) stays purely the NMS containment carve-out and gains no size semantics.
+- **REQ-190** — The same table has a **Paste YAML** button that reads the clipboard and fills
+  the per-class overrides from it, so a tuned configuration moves between projects without
+  retyping. It applies only the classes currently **selected in this modal**; a pasted class
+  that is not selected is reported as ignored rather than written, because `buildClassParams`
+  walks every entry and an unseen override would otherwise ride along in `class_params`.
+  Numbers merge per field (a pasted block overwrites the four numbers, leaves other state
+  alone); `container` goes out as one `PATCH /projects/{id} {containers: {classId: bool}}`
+  covering every flag that changed, reverted together with a message if the save is rejected.
+  Parsing is strict on purpose — a subset reader for exactly what Copy emits (`#` comments,
+  `class:` at the left margin, `key: value` indented under it) rather than a general YAML
+  engine, and **any** malformed line throws with its line number and applies **nothing**, so a
+  half-understood paste cannot quietly set wrong parameters. A value must *look* like a number,
+  not merely start like one (`0.5abc` is rejected rather than read as `0.5`), and values
+  outside 0–1 are rejected the same way. Clipboard **read** has no legacy fallback, so a blocked or denied read (the app
+  served over plain http on a LAN address, or the browser prompt refused) is reported in the
+  status line instead of failing silently. Paste never touches the global sliders.
 
 ## E. Review & correction