Address copilot pass 4 on #2

- lib/lws-cid.js: VM controllers are now compared against the
  profile's declared `controller` (absolutized), with fallback to
  `@id`. The previous code used `@id` unconditionally, which would
  incorrectly fail otherwise-valid delegated-control profiles. Also
  fixes the converse: a delegated profile with VMs still pointing at
  the original WebID now correctly fails (verified with a mismatched
  test case).
- doctor.css + doctor.js: copy-status no longer renders error text in
  the success color. Added `.success` and `.error` modifier classes
  with a neutral default; click handler sets the appropriate one.

Author: melvincarvalho

doctor.css

@@ -266,8 +266,10 @@ a { color: var(--accent); }
 .add-key .copy-status {
   margin-left: 10px;
   font-size: 12px;
-  color: var(--pass);
+  color: var(--muted);
 }
+.add-key .copy-status.success { color: var(--pass); }
+.add-key .copy-status.error   { color: var(--fail); }
 
 .kv {
   display: grid;

doctor.js

@@ -193,6 +193,7 @@ function clearSignerOutput() {
   snippetTarget.textContent = '';
   connectButton.textContent = 'Connect signer';
   copyStatus.textContent = '';
+  copyStatus.className = 'copy-status';
 }
 
 function detectSigner() {
@@ -255,11 +256,16 @@ function renderSnippet(xOnlyHex, webId, docUrl) {
 copyButton.addEventListener('click', async () => {
   try {
     await navigator.clipboard.writeText(snippetEl.textContent);
+    copyStatus.className = 'copy-status success';
     copyStatus.textContent = 'Copied.';
   } catch (err) {
+    copyStatus.className = 'copy-status error';
     copyStatus.textContent = `Couldn't copy: ${err.message || err}`;
   }
-  setTimeout(() => { copyStatus.textContent = ''; }, 2500);
+  setTimeout(() => {
+    copyStatus.textContent = '';
+    copyStatus.className = 'copy-status';
+  }, 2500);
 });
 
 function renderChecks(checks) {

lib/lws-cid.js

@@ -128,14 +128,19 @@ export function runLwsCidChecks(profile, { webIdUrl }) {
     });
 
     // Entry-level checks. VM controllers are compared against the
-    // profile's @id (with fragment if present) — that matches the CID
-    // v1 self-control pattern where the outer profile.controller is
-    // also the WebID itself, not the bare document URL.
-    const profileIdAbs = absolutize(id, requestedNoHash);
+    // profile's declared `controller` (absolutized), with a fallback
+    // to `@id`. Most profiles are self-controlled (controller === @id)
+    // so the two are equal; for delegated-control profiles, VMs are
+    // expected to be controlled by whoever the profile says controls
+    // it, not by the WebID itself.
+    const expectedCtrlSource = controller !== undefined
+      ? (typeof controller === 'string' ? controller : controller['@id'])
+      : id;
+    const expectedCtrl = absolutize(expectedCtrlSource, requestedNoHash);
     const seenIds = new Set();
     let allOk = true;
     for (const [i, vm] of vms.entries()) {
-      const probs = validateVerificationMethod(vm, requestedNoHash, profileIdAbs);
+      const probs = validateVerificationMethod(vm, requestedNoHash, expectedCtrl);
       if (probs.length === 0) continue;
       allOk = false;
       out.push({