fix: keep admin protocol options within viewport

[sean0407]

Summary

ProtocolsDropdown now caps its popup to Radix Popper's available viewport height and lets the options scroll inside it.

-<PopoverContent align="start" className="w-72 p-1">
+<PopoverContent align="start" className="max-h-[var(--radix-popper-available-height)] w-72 overflow-y-auto p-1">

Closes #853.

Evidence

• Before: In an isolated 800×500 browser view of the component, the menu began at y=-240px and extended to y=274px; all 512px of content fit in the element, so it could not scroll.
• After: The menu spans y=0–274px, with 272px of client height for 512px of content. The final option is visible after scrolling.

Verification

• Isolated browser check of the actual ProtocolsDropdown component: before/after viewport bounds and scroll access verified.
• ./node_modules/.bin/biome lint features/admin/components/sections/upstreams/upstreams-models-dialog.tsx — passed.
• ./node_modules/.bin/tsc --noEmit --pretty false — passed.
• node scripts/check-architecture.mjs — passed (23 rules, 891 files).

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Admin console

Screenshots, API examples, or logs

The before/after browser measurements above show the clipping and the corrected scrollable viewport.

Configuration, migration, and compatibility notes

No configuration or migration changes.

Documentation

• Documentation is not needed for this change.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.

Merge Danger

Door: Two-way

Blast Radius: Low — only the admin protocol option popup height and scrolling change.