Add native Markdown previews to Review

[williamhrs]

Uploaded text/markdown files currently show “Preview not supported.” This adds a formatted Preview and original Source view for the selected immutable file, with exact-version download and existing review comments. Original bytes and storage APIs remain unchanged.

Related scope proposal: #78

The product spec currently excludes Markdown rendering and syntax highlighting, so this explicitly proposes a scope change under SCP-002 rather than a bug fix. This PR remains a draft for maintainers to review that direction.

The implementation adds GFM formatting, a finite lazy Shiki language set, version-pinned bundled resources, and bounded Mermaid rendering. Diagrams run in a separate opaque frame with network-denying CSP and a validated message boundary; completed HTML/SVG is sanitized before entering the existing review sandbox. Source remains readable after preview lease failure, and abandoned work is cancelled.

Affected requirements: MDV-001, MDV-002, MDV-003. No backend processing, database migration, document editing, or MDX execution is introduced.

Validation completed so far:

• Web typecheck and production application build.
• Type-aware lint and conformance ledger/test-ID validation.
• Five resource/heading boundary unit tests.
• Initial expanded browser run: seven of nine cases passed. The latest run passed two of nine, with assertion and timeout failures; browser verification is incomplete.

pnpm verify:iteration passed its lint, typecheck, build, and documentation stages, then encountered MCP discovery and CLI authentication/publishing test failures. That run was stopped after failures; the full gate has not passed. Browser qualification and the full gate remain required before this draft can be marked ready. The diagram bundle is about 3.7 MB minified and loads only for diagram fences; maintainers may prefer to split that optional support into a follow-up.