Add s.svg() schema with themeable color variables - #480

Adds a new schema that stores an svg as a json node tree, so custom icons
can be content rather than an opaque binary. Until now an svg could only be
an s.image() / s.file() reference to a blob: not recolorable, not validatable
against the design system, not diffable.

Colors are declared as *variables* rather than baked hexes:

    s.svg({
      width: 24,
      height: 24,
      variables: { brand: "#0055ff", line: "currentColor" },
    })

The color on a variable is an example. It is what the editor previews, what
svgVarsCss() writes into the stylesheet, and what a pasted literal color is
matched against on import. What actually renders resolves from
--val-svg-<name>, so one icon supports currentColor, dark mode and per-usage
overrides:

    <style>{svgVarsCss(iconSchema)}</style>
    <ValSvg src={icons.bell} size={32} />
    <ValSvg src={icons.bell} size={32} vars={{ brand: "var(--danger)" }} />

    [data-theme="dark"] { --val-svg-brand: #6699ff }

How permissive to be about raw colors is up to the schema: `literals` is
"forbid" (the default), "allow", or an allowlist. This is enforced at the type
level as well as by the validator, so a raw hex in a .val.ts is a compile
error, not only a validation error.

Notable decisions:

- Svg sources are excluded from stega encoding entirely. Every string in an
  svg (d, viewBox, points, transform) is machine parsed, so injecting
  invisible characters would corrupt the icon. The source path is attached as
  an ordinary serializable field (SVG_VAL_PATH) instead, which ValSvg turns
  into data-val-path - a symbol would not survive RSC serialization.

- ValSvg builds React elements tag by tag; there is no innerHTML anywhere.
  Safety is therefore entirely the allowlist, and it is a strict per-tag
  allowlist of exact attribute names rather than an on* denylist: React
  renders unknown attributes on host elements verbatim, and onload does fire
  on svg elements. script, style, foreignObject, a, use, image, animation and
  filter elements are rejected, as are style/id/class/href/xlink/data-*.
  d, points, transform and stroke-dasharray are the only free-form strings
  left, and each is regex constrained and length capped.

- The svg parser is hand rolled and dependency free. @valbuild/shared ships
  into every user's server bundle, and svg-as-xml is a small grammar. Entity
  declarations and doctypes with an internal subset are rejected outright
  (XXE / billion laughs). Parser output is filtered through the allowlist
  before anything else sees it - the parser is not a security boundary.

- Import matches literal colors onto variables by exact normalized value, or
  by a variable's declared match aliases. Nothing is snapped to a nearby
  variable unless that variable opted in with `tolerance`; anything left over
  is reported so the editor can ask. Quietly rewriting a brand color is worse
  than asking about it.

- No new ValidationFix code: because the palette lives only in the schema and
  is never mirrored into the source, there is nothing that can drift and
  nothing to repair.

Gradients are deliberately out of scope for now. Adding them later needs a
third attribute value kind for url(#...) plus per-instance id namespacing, and
is additive rather than breaking.

Also adds the editor field (paste markup or drop a .svg, with a prompt for
colors that are not in the palette), storybook stories for it, and an icons
module in examples/next.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3Wbr5HZDGfdRzAnZ5aH7n

Follow-up on review.

ValSvg's `vars` now works exactly like ValRichText's `theme`: optional, but
exhaustive if given. Every variable the schema declares must be mapped to a
color, so adding one to `s.svg({ variables })` is a compile error at every call
site until someone revisits it - which is the point. A value is any css color,
`null` means "leave it to css" and emits var(--val-svg-<name>, currentColor).

Reworked the editor field around how it is actually used. Icons are read far
more often than they are replaced, so the tile *is* the control and it is the
only thing on screen by default: drop an svg on it, paste markup into it, or
click it to pick a file. The textarea and the button row are gone, the markup
is behind an accordion, and the mapping controls appear only when an import
needs a decision. While mapping, the tile previews the icon being imported in
its original colors, so you can see what you dropped and watch it move onto the
palette as you pick - it is not committed until every color has somewhere to go.

Docs: a Svg section in packages/next/README.md following the RichText section's
shape (schema, initializing, rendering, the vars note, editing, the type, full
custom), and a "Working with Svg" section in .agent/rules.md - shared by
CLAUDE.md, the cursor rules and the copilot instructions, which all symlink to
it - covering the invariants that are easy to break: never stega encode an svg,
the allowlist is the whole security boundary, the parser is not, vars is
exhaustive on purpose, and the palette lives only in the schema.

Also adds ValSvg render tests (variable resolution, the css fallback, size
precedence, title/aria, data-val-path) plus a type-level check that vars stays
exhaustive. That needed @types/react-dom in packages/react; it resolves to the
18.2.17 already used by next/ui/examples, so there is still exactly one copy of
@types/react and the duplicate-copy JSX hazard is not reintroduced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3Wbr5HZDGfdRzAnZ5aH7n

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3Wbr5HZDGfdRzAnZ5aH7n

- `decodeXmlEntities` called `String.fromCodePoint` on any FINITE code point.
  `�` and `�` are finite and out of range, so parsing svg
  markup that contains one threw a RangeError instead of reporting the markup.
  Out-of-range entities are now left as written. The `#X` (uppercase) branch was
  dead — the regex only matches lowercase `x`, which is also the only spelling
  the XML CharRef production allows — so it is gone and its case is covered.

- `SerializedSvgSchema` used `SvgOptions.optional() as any`. The mismatch was
  one field: `aspectRatio` is `number | \`${number}:${number}\`` in core, and
  `z.string()` parses to `string`. Narrowing that field with a `z.custom` lets
  the options object be typed as `z.ZodType<SvgOptions>` and the `as any` go,
  so the other seven fields are checked against core again.

- The two svg field-provider messages reported an array and a `null` as
  "object", since `typeof` cannot tell them apart. They now report the runtime
  kind. The neighbouring pre-existing messages are left alone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VFs5x1hQ9MiaDn4aQyANTp

…ors-tmi9jk

Six conflicts, all from #453 landing on main.

Source / Selector: both sides add a source type to the same unions -
main's JsonSource and this branch's SvgSource. Both are kept, and the
Selector<T> chain gains a rung for each.

search: main extracted the index building out of search.worker.ts into
searchIndex.ts and deleted createSearchIndex.ts. This branch's only
change there was to index an svg by its path (nothing inside an icon is
searchable text), which is carried over to searchIndex.ts. In the new
shape `index.add` already prefixes the cleaned path and skips an entry
with no searchText at all, so the svg case sets one - "svg", which
doubles as a way to list every icon, mirroring richtext's fallback label.

ValFieldProvider: adjacent imports, both kept.

Two follow-ons the textual merge could not see:

- Schema gained an abstract executeCustomValidateAt, so SvgSchema has to
  implement it (same shape as DateSchema's).
- jsonValuesLoadRequirements has a never-guarded switch over every schema
  type; an svg holds no reference to another module, so it joins the ones
  that return false. Without it the guard would fall to its conservative
  default and demand a full entry load for any record containing an icon.