[Browser] Paste does nothing on an http page outside localhost: navigator.clipboard is undefined, and the paste fallback reads its items too late #22655

Describe the bug

In an Avalonia browser app opened over plain http at an address other than localhost (for example a device's LAN address, http://192.168.1.20:8080/), pasting into a TextBox does nothing. Such a page isn't a secure context, so the browser doesn't define navigator.clipboard at all, and two faults in input.ts together leave no path that pastes:

1. readClipboard throws before it reaches the paste-event fallback. It reads clipboard.read without checking that navigator.clipboard exists (input.ts#L113-L120). The TypeError isn't a NotAllowedError, so it is rethrown, and the fallback meant for browsers without read/readText (note #2) is never used.
2. The fallback loses the text even when it is reached. Since the clipboard rework (Clipboard rework #19347) the paste listener resolves with the event's DataTransferItems (#L70-L76), and the text is read from them later with getAsString (#L241). By then the event has ended and the browser has locked the DataTransfer: the items' kind and type are empty, and getAsString never calls back. In a real paste in Chrome, with fault 1 bypassed by giving the tab an empty navigator.clipboard object, the item was kind: "string" with 7 characters during the event, and kind: "" right after it. The fallback before the rework (Add "readClipboardText" workaround for Mozilla #11010) read the text inside the event.

From the source, writeClipboard has the same unguarded access (#L148-L158), so copy and cut likely fail on such a page too; I haven't checked that.

To Reproduce

1. Publish any Avalonia browser app with a TextBox, and serve it from a static web server on the local network.
2. Open it in Chrome by the machine's LAN address over http, not localhost, e.g. http://192.168.1.20:8080/.
3. Copy some text, click into the TextBox, and press Ctrl+V.

Observed: nothing is pasted.

Expected behavior

The text is pasted through the paste-event fallback, as in browsers without clipboard.readText. For example:

1. clipboard?.read and clipboard?.readText in readClipboard (and the same guard in writeClipboard), so a page without the API falls through to the fallback.
2. The paste listener reads the strings while the event runs (clipboardData.getData(type)) and resolves with those values rather than with the DataTransferItems.

Avalonia version

12.1.3 and 12.1.4; the code is the same on main as of 2026-10-30.

OS

Browser (WebAssembly): Chrome 151 on Windows 11

Additional context

Our case: a TV app serves its Avalonia browser UI over plain http on the local network, and the user opens it on a phone, by the TV's LAN address, to paste a long access key. A LAN address can't get a publicly trusted certificate, so that page can't be a secure context. Because of these faults we had to put the browser's own <textarea> over the TextBox, through a NativeControlHost, so that the browser's native paste works. We'd like to drop it once Avalonia pastes on such a page.