fix(ui-components): defer object URL revoke in panel downloads

[Shivansh1205]

Fixes #1030

Problem

a.click() does not perform a download, it schedules one. The browser fetches the
blob: URL afterwards, on its own timeline. Revoking the URL on the next line destroys
the handle immediately, so whether the export works is a race between the browser
starting its fetch and JavaScript tearing the blob down.

Three panels hand-roll the download and revoke synchronously:

Component	Button
kinematics-panel-overlay	Export TSV
masterclass-panel-overlay	Export results
session-pill	.phnxreplay download

The user clicks export and silently gets nothing — no file, no error, no console
message. Larger blobs lose the race more often, so long masterclass sessions and big
track collections are hit hardest.

Why this shape of fix

The repo already solved this once. saveFile defers its revoke to the next tick and
carries a comment explaining why (helpers/file.ts#L18-L23). These three panels never
call saveFile; they reimplement it and reintroduce the bug it fixed.

So the fix is to match the established pattern rather than invent one — defer the
revoke with setTimeout, exactly as saveFile does. The URL is still revoked, so
nothing leaks; it just happens once the browser holds its own reference.

The kinematics and masterclass anchors are additionally hidden (display: none) and
.remove()d after the click, again mirroring saveFile, so an unstyled anchor never
lands in the layout. session-pill already appended and removed its anchor, so only
its revoke changed.

I deliberately kept this to the revoke race and did not refactor the three call sites
onto saveFile itself — saveFile takes a string and these pass a Blob
(session-pill's comes straight from SessionManager), so unifying them is an API
change that does not belong in a bug fix.

Relationship to #992

#992 fixed saveFile for this exact race and stated these call sites "all revoke
correctly". They do revoke, which is why they were passed over, but they revoke in
the wrong task. This is the other half of that fix, not a new regression.

Tests

Added coverage for all three components, asserting the user-visible contract: the URL
is not revoked synchronously, and is revoked after the tick.

• kinematics-panel-overlay.component.test.ts (new)
• session-pill.component.test.ts (new)
• masterclass-panel-overlay.component.test.ts (new export block appended)

Each suite also covers that no anchor is left in the document, and the masterclass and
session-pill suites cover the empty/no-blob early return.

Failing before this change: the "does not revoke the object URL synchronously"
case in the kinematics and masterclass suites. Verified by running the kinematics test
against unmodified code:

× does not revoke the object URL synchronously
  expect(jest.fn()).not.toHaveBeenCalled()
  Expected number of calls: 0
  Received number of calls: 1

The session-pill suite is new, so it has no before-state.

Components are instantiated via Object.create(Cls.prototype) with the few fields the
export method touches, matching the existing #923 tests in the masterclass file and
avoiding TestBed for methods that need no DI.

Verification

• Full phoenix-ng suite: 64 suites / 230 tests passed, 0 failures.
• eslint clean on all three component directories.
• No pre-existing test failures were found, so none are being carried.
• prettier --check warns on these files, but it warns identically on a clean tree —
  the checkout is CRLF and prettier normalises to LF. Not caused by this PR, and left
  alone to keep the diff to the bug.

[github-actions]

🚀 Preview deployed: http://phoenix-pr-1031.surge.sh

Built from 6f909a3.