Security, performance, bug fixes, and TDS improvements

Security:
- HIGH-1: Validate hex color format before CSS interpolation in sanitize.ts
- HIGH-5: Add sandbox attribute to OpenStreetMap iframe
- MED-1: Fix permissive URL scheme regex in LINKIFY_OPTS
- MED-3/HIGH-4: Add .js.map blocking + CSP header to nginx config
- LOW-2: Validate OIDC authUrl scheme before window.open
- Accessibility: Remove maximum-scale=1.0 from viewport meta (WCAG 1.4.4)

Performance:
- O(1) Map index in computePositions (was O(M×T) findIndex per member)
- Add RoomMemberEvent.Membership subscription so positions update on join/leave
- Fix uncleaned 2000ms setTimeout in RoomTimeline useLayoutEffect

Bug fixes:
- BUG-5: Add QUEUED/CANCELLED cases to DeliveryStatus component
- BUG-6: Guard DeliveryStatus against state events via isState() check
- BUG-10: Clamp PiP position on window resize
- BUG-14: Separate runLotusBootSequence into dedicated useEffect([lotusTerminal])
- Fix aria-live on typing indicator (WCAG 4.1.3)
- Add aria-label + aria-multiline to message editor

TDS (Lotus Terminal Design System):
- Add reaction chip styles (dark + light mode)
- Add GIF picker CSS via globalStyle instead of runtime injection
- Add URL preview styles (dark + light mode)
- Add complete GIF picker light-mode TDS block (was missing)

src/app/features/room/message/Message.tsx

@@ -91,8 +91,10 @@ function DeliveryStatus({ status, lotusTerminal }: { status: string | null; lotu
   let icon: string;
   let label: string;
   let colorStyle: string;
-  if (status === EventStatus.NOT_SENT) {
+  if (status === EventStatus.NOT_SENT || status === EventStatus.CANCELLED) {
     icon = '✕'; label = 'Failed to send'; colorStyle = lotusTerminal ? '#FF3B3B' : color.Critical.Main;
+  } else if (status === EventStatus.QUEUED) {
+    icon = '⏳'; label = 'Queued'; colorStyle = lotusTerminal ? 'rgba(0,212,255,0.45)' : color.Secondary.Main;
   } else if (status === EventStatus.SENDING || status === EventStatus.ENCRYPTING) {
     icon = '⟳'; label = 'Sending...'; colorStyle = lotusTerminal ? 'rgba(0,212,255,0.60)' : color.Secondary.Main;
   } else {
@@ -888,7 +890,7 @@ export const Message = as<'div', MessageProps>(
             userIds={readReceiptUsers}
           />
         )}
-        {isMine && readReceiptUsers.length === 0 && (
+        {isMine && !mEvent.isState() && readReceiptUsers.length === 0 && (
           <DeliveryStatus status={mEvent.status} lotusTerminal={!!lotusTerminal} />
         )}
       </Box>