Some browsers allow you to run document.execCommand("copy") and document.execCommand("paste"), in some contexts, but due to security considerations (don’t want to give unfettered access to the clipboard) I think the second is rather locked down. Don’t know the details off-hand, but that should give you a direction to start looking in.
Since I asked, I’ve stumbled over document.execCommand as well, implemented it and can say: You are right in your assumption that “paste” is locked down (which is a problem out of scope of prosemirror).
I was hoping there is some kind of “weird trick” that solves my problem, but no luck it seems.
Currently I’m looking into manifest.json. Maybe I can request permission for “clipboardRead”…