feat: add shared read-only CodeMirror viewer

[BorisTyshkevich]

What & why

Adds the reusable read-only CodeMirror foundation from #213 behind an injected app.CodeViewer seam.

The viewer supports complete text, JSON, SQL, XML/HTML source, and plain Markdown source with line numbers, local search, selection/copy, compartment-based wrapping/language changes, correct detached-document roots, and idempotent teardown. The editable SQL editor now shares only presentation/search extensions and existing .sql-* token classes; history, completion, hover, schema loading, drag/drop, undo/tab parking, and app-state synchronization remain editor-only.

Adds only @codemirror/lang-json and @codemirror/lang-xml. Measured single-file bundle impact: +18,063 bytes raw / +7,059 bytes gzip. Production dependency audit reports 0 vulnerabilities.

Closes #213

Verification

• npm test — 77 files, 2,390 tests, coverage gate green
• npm run build — single-file artifact succeeds
• Focused real-adapter/app tests — 369 tests green
• New Playwright test covers detached realm ownership, trusted typing rejection, wrapping, Mod-f search, and idempotent teardown across the existing three-engine matrix
• Local Playwright engines exit with host-level SIGTRAP before test code; CI is the authoritative three-engine run

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• New runtime packages are deliberate, limited to CodeMirror JSON/XML modes, and attributed
• README / CHANGELOG.md ([Unreleased]) updated
• Reconciled affected ADR/CHANGELOG; roadmap Roadmap to 1.0.0 #68 links this PR and Shared read-only CodeMirror viewer for structured and large text #213 acceptance is reconciled

[BorisTyshkevich]

CI follow-up: the first E2E run exposed that editable.of(false) removes the viewer content surface from the tab/focus order, so viewer.focus() could not establish a keyboard target and Mod-f never reached CodeMirror. Commit 0d44b4e adds an explicit tabindex="0", with unit and E2E assertions. Local Vitest coverage and build are green; awaiting the rerun of the full three-engine Actions job.