feat(ui): searchable popup pickers for PR scope and model visibility

Replace the cramped PR multi-select with a modal: every repo#pr as a
checkbox (with model coverage), a search box, and all/none that apply to
the search results. The model hider moves to the same popup style — the
per-row × and the hidden-chips bar are gone; both pickers live as
buttons in the filter row showing their current state.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -138,10 +138,11 @@ ungraded, points, **points-per-minute**, points-per-run, by-severity — with **
 (date range, repo, provider, model, lens, grade/severity), free-text search, and a click-to-scope
 findings detail table.
 
-Comparisons can be scoped to **specific PRs**: a multi-select lists every `repo#pr` with how many
-models ran it (`steve/x#12 · 3/5 models`) — pick the PRs you want and the entire table (runs,
-minutes, findings, points) counts only those, so a model with 2 runs can be compared against one
-with 60 on exactly the work you choose.
+Comparisons can be scoped to **specific PRs**: the **PRs** button opens a searchable checkbox popup
+listing every `repo#pr` with how many models ran it (`steve/x#12 · 3/5 models`) — tick the PRs you
+want and the entire table (runs, minutes, findings, points) counts only those, so a model with 2
+runs can be compared against one with 60 on exactly the work you choose. **all**/**none** apply to
+the current search, so you can filter to a repo and select all its PRs in one click.
 
 True to the store's "no points" rule, **scoring lives in the browser**: the page has an editable
 points curve (default `trivial=1, small=3, medium=5, high=8, critical=20`) and computes
@@ -164,11 +165,11 @@ Its mirror, **solo-error penalty ×** (default `1.5`), multiplies the FP penalty
 was made by **only that model** — a unique wrong claim is noisier than a shared mistake. So a
 Blocking-claimed solo FP costs `high(8) × -0.5 × 1.5 = -6` vs `-4` for a shared one. Set to `1` to disable.
 
-**Hiding models.** Each scoreboard row has a small **×** to hide that model — handy for retired ones
-(e.g. `m1`) you no longer want cluttering the view. Hidden models drop out of the table, the totals,
-and the findings drill-down (but **not** from solo-ness, which stays computed against all models — hiding
-is a view filter, not a rescoring). The hidden set persists in `localStorage` across reloads; a
-**hidden (N): …** bar lists them as click-to-restore chips, with a **show all** to clear.
+**Hiding models.** The **models shown** button opens the same style of popup with a checkbox per
+model — untick to hide one (handy for retired ones, e.g. `m1`), re-tick to restore. Hidden models
+drop out of the table, the totals, and the findings drill-down (but **not** from solo-ness, which
+stays computed against all models — hiding is a view filter, not a rescoring). The hidden set
+persists in `localStorage` across reloads; unlike the other filters, **reset** doesn't touch it.
 
 Auth: the `/ui` shell is public (it holds no data); paste the store token into its **connect** box,
 or open `/ui?token=<token>` once (remembered in `localStorage`). Prefer your own dashboard? Point