Re-implement collapsible excerpt overflow state checking

In addition to the content changing, the window resizing and media loading,
another way that the excerpt's overflow state can change is if it or a parent
element's visibility changes.

Since there isn't a generic, performant way to watch the visibility of DOM
elements, the change here adds a scope watch which tests for the presence of
the 'ng-hide' class used by the ng-show and ng-hide directives on parent
elements, since that is the only method of changing visibility that we actually
need to support at the moment.

Excerpts update their overflow state outside of the Angular $digest
cycle. The usual way to deal with this is to wrap the update in a
$scope.$apply() call. However, this triggers a full $digest cycle, which
we want to avoid if many excerpts update their state at the same time -
eg. if we have a large number of annotation cards.

This commit instead explicitly invokes the $digest _only_ in the
affected annotation card and then only if the collapsible state of an
annotation body actually changed.

This makes it possible to write isolated tests for just the overflow
state and content style recalculation aspects of <excerpt> components.

It also simplifies the <excerpt> component tests by making it easier to
reason about when the excerpt's overflow state will have been
recalculated and the directive's state updated accordingly.

rAF is not available in PhantomJS 1.x but is supported by all of our
target browsers (IE >= 10).

Previously the overflowing state of the excerpt was computed implicitly
by the overflowing() method, which was called from several other
controller functions.

There were several problems with this approach:

 1. Since this method calls Element.scrollHeight, it triggered an
    expensive synchronous layout flush.
 2. In certain situations, this could trigger a loop where the
    overflowing flag was continually flipped (see #2960)
 3  It was unpredictable when the overflowing state would be recomputed.

This commit instead opts for a different approach which is more explicit
about when the state is recomputed, based on the assumption that the
<excerpt>'s content size is a function of:

 1. The inputs to the <excerpt>'s content (eg. the text of a quote, the body
    of an annotation)
 2. The sidebar window's size
 3. The dimensions of any embedded media

The content size is then computed and updated as follows:

 1. When the <excerpt> is initially created, an async computation of
    the scrollHeight is scheduled. The calculation unfortunately needs
    to be async because the content may contain Angular directives which
    take several $digest cycles to fully process.

 2. The <excerpt> listens for changes to the content's data (via a
    'contentData' property), media 'load' events and window 'resize'
    events and recomputes the overflow state in response to any of
    these.

There are a couple of other fixes here:

 - Use an optional boolean property for the 'enabled' input,
   rather than a function. The app passed a function to this property
   but the tests passed a boolean.

Fixes #2960

Replace node page router

We don't need all the client-side routing part, we only need to be able
to selectively run certain JavaScript code depending on which site the
user is at the moment.
This implementation is not as advanced as the one from the `page`
package, or what is possible with the `url-pattern` package. But we
don't need any fancy URL matching at the moment, once we do we can
revisit and maybe introduce something like `url-pattern` instead of just
a crude `document.location.pathname === path`.

Add tests for authentication policy

Scroll to annotation when clicking at bottom of collapsed quote

Fix 'Location' sort order for annotations

Use require() for templates

For consistency with how other transforms are specified, specify the
stringify transform in package.json instead of in code in the
create-bundle.js script and the Karma config.

Since components now require() their own templates, it is no longer
necessary to use a preprocessor to load them.

Include Angular component templates as strings in the app bundle using
the stringify Browserify transform and use them from directives using
'template' instead of 'templateUrl'.

This is faster, because it avoids going through the async $http
machinery to load templates, but it is also synchronous, which generally
means fewer surprises due to async template loading and specifically in
the context of the <excerpt> directive will be useful as it will make it
possible for the <excerpt> directive to measure the height of its
content in the link function, because all components inside the
exercept's content will have been fully resolved at that point.

Collapsed quotes can be expanded either explicitly by clicking the
'More' link on the quote or 'implicitly' by clicking anywhere at the
bottom of the quote. In that case, the clicked annotation should
be scrolled into view.

This commit separates the behavior when clicking on the toggle link vs
clicking at the bottom of the card.

In the template, the bottom area has been moved before the inline
controls so that the inline controls are above the bottom area and
receive click events first.

1398661 extracted the code for getting a location from an annotation
into a separate module. However that function expects an Annotation but
the sort predicate function was being passed a Thread.

Consequently the predicate function was returning
Number.POSITIVE_INFINITY for every thread and so sort ordering fell back
to the default 'tie-breaker' comparator - which is the original index of
the element in the list being sorted.

Fixes #3106

Postgres Write 2/4: Model code for creating new annotations in Postgres

Live reload development tool for Hypothesis client

If multiple asset bundles are regenerated in quick succession, including
JS or template files, the client might try to reload whilst some of the
bundles are still being regenerated, resulting in the client failing to
load.

This commit reduces the likelihood of this happening by debouncing
live-reload notifications and makes a note of the issue.

This implements support and a test environment
in which the Hypothesis client can live reload
when scripts, styles etc. are changed.

Live reloading when scripts change currently requires
support from the hosting page.

There are two parts to this:

 - A server which serves test pages
   with the Hypothesis client embedded and notifies
   it when front-end assets (styles, scripts) are changed.

   Test pages are served at http://localhost:3000/<any path>
   by default.

 - A small client script which connects to the server and
   listens for notifications of asset changes.

   When styles change it will reload styles for the page.

   When scripts or Angular templates change it will send a
   request to the top-level page to reload.

   This enables reloading to work when changing
   both the sidebar app and Annotator code but also avoids
   the need to manually unload the existing Annotator instance
   before reloading.

CSP violation: admin confirm users delete

Which fixes a CSP violation, but it was also always the preferred
solution. This wasn't done in the first place as we didn't have any JS
bundle set up for admin, that exists now, so it's time to move the
confirmation dialog triggering into the proper place.

Rename postgres_read feature flag to postgres

In order to be able to execute specific JS code on certain admin pages.

So we get reports about JS errors in the admin bundle.

This is particularily important since we introduced a bug in the past
that didn't confirm the users delete form which could have led to
deleting users and all their data without a confirmation dialog.

Make client injection robust to pages that replace the URL fragment as they load

Display 'Show all N public annotations' message when there is a selection

Sites such as Medium and EBSCOHost modify the URL fragment as the page
loads, causing direct-link annotation ID fragments to be lost by the
time the app's init code runs.

When a tab's URL changes, extract the '#annotations' fragment and pass
it to the application as configuration info when the app is injected.
If the URL fragment is removed or replaced by client-side JS as the page
loads, the app will still get the original annotation ID that was
captured by the extension prior to the page load completing.

The direct-linked ID is remembered until the sidebar is successfully
injected, at which point it is cleared so that it is not re-used on the
next navigation within the tab.

Provide a way for the browser extension to pass config info to the app,
by running a content script which injects a <meta> tag into the page
with this form:

  <meta name="hypothesis-config" content="<JSON data>">

This configuration info is then merged with the result of the
hypothesisConfig() function, with the hypothesisConfig() function taking
priority.

When parsing the '#annotations' fragment, ignore any extra content
outside of the url-safe-base64 character set for annotation IDs.

This helps in cases where extra content has been appended to the URL
fragment after '#annotations:<ID>', before the client loads. This
happens at one point during loading of Medium.com pages for example.

Remove incontext links for replies

In the case when the selection has been set as a result of visiting a
direct-linked annotation, this makes it more obvious that there are
other annotations on the page to see.

Uri normalize unicode

Avoid showing 'Clear Selection' or 'Clear Search' buttons whilst loading

When loading annotations whilst a search query is active or selection is
present, avoid showing the 'Clear Search' or 'Clear Selection' buttons
until the search has actually completed and we know whether any
annotations match the query or selection.

This fixes the flash of the 'Clear Selection' button when viewing a
direct-linked annotation.

Fix broken loggedout CTA.