Auto-format token and join-code inputs with dashes while typing

Shared wireCodeMask helper: uppercase, dash every 4 chars, raw-length
cap, caret preserved, backspace over a dash deletes the char before it.

public/js/dom.js

@@ -1,4 +1,5 @@
 // Tiny DOM helpers — no framework, just ergonomic element creation.
+import { groupCode, normalizeCode } from './format.js';
 
 // el('div', { class: 'x', onClick: fn }, child, child, ...)
 // Attrs: class, dataset(obj), style(obj), html(innerHTML), on<Event>(fn),
@@ -75,6 +76,27 @@ export function emptyState(title, subtitle, action) {
   );
 }
 
+// Live code mask for token/join-code inputs: uppercase + a dash after every 4
+// characters as you type, capped at rawMax raw characters, keeping the caret
+// anchored to the same raw character. Backspacing onto a dash deletes the
+// character before it (otherwise the dash would just reappear and the key
+// would look dead).
+export function wireCodeMask(input, rawMax) {
+  input.addEventListener('keydown', (e) => {
+    const pos = input.selectionStart;
+    if (e.key === 'Backspace' && pos === input.selectionEnd && input.value[pos - 1] === '-') {
+      input.setSelectionRange(pos - 1, pos - 1);
+    }
+  });
+  input.addEventListener('input', () => {
+    const rawBefore = Math.min(rawMax, normalizeCode(input.value.slice(0, input.selectionStart)).length);
+    const raw = normalizeCode(input.value).slice(0, rawMax);
+    input.value = groupCode(raw, 4);
+    const caret = rawBefore + (rawBefore > 0 ? Math.floor((rawBefore - 1) / 4) : 0);
+    input.setSelectionRange(caret, caret);
+  });
+}
+
 let toastHost = null;
 export function toast(message, type = 'error', ms = 4200) {
   if (!toastHost) {