Security, performance, bug fixes, and TDS improvements

Security:
- HIGH-1: Validate hex color format before CSS interpolation in sanitize.ts
- HIGH-5: Add sandbox attribute to OpenStreetMap iframe
- MED-1: Fix permissive URL scheme regex in LINKIFY_OPTS
- MED-3/HIGH-4: Add .js.map blocking + CSP header to nginx config
- LOW-2: Validate OIDC authUrl scheme before window.open
- Accessibility: Remove maximum-scale=1.0 from viewport meta (WCAG 1.4.4)

Performance:
- O(1) Map index in computePositions (was O(M×T) findIndex per member)
- Add RoomMemberEvent.Membership subscription so positions update on join/leave
- Fix uncleaned 2000ms setTimeout in RoomTimeline useLayoutEffect

Bug fixes:
- BUG-5: Add QUEUED/CANCELLED cases to DeliveryStatus component
- BUG-6: Guard DeliveryStatus against state events via isState() check
- BUG-10: Clamp PiP position on window resize
- BUG-14: Separate runLotusBootSequence into dedicated useEffect([lotusTerminal])
- Fix aria-live on typing indicator (WCAG 4.1.3)
- Add aria-label + aria-multiline to message editor

TDS (Lotus Terminal Design System):
- Add reaction chip styles (dark + light mode)
- Add GIF picker CSS via globalStyle instead of runtime injection
- Add URL preview styles (dark + light mode)
- Add complete GIF picker light-mode TDS block (was missing)

src/app/pages/ThemeManager.tsx

@@ -50,6 +50,11 @@ export function AuthRouteThemeManager({ children }: { children: ReactNode }) {
     ? (terminalIsLight ? LotusTerminalLightTheme : LotusTerminalTheme)
     : activeTheme;
 
+  // Boot animation only fires when lotusTerminal is toggled on, not on every theme change
+  useEffect(() => {
+    if (lotusTerminal) runLotusBootSequence();
+  }, [lotusTerminal]);
+
   useEffect(() => {
     document.body.className = '';
     document.body.classList.add(configClass, varsClass);
@@ -57,7 +62,6 @@ export function AuthRouteThemeManager({ children }: { children: ReactNode }) {
     if (lotusTerminal) {
       document.documentElement.setAttribute('data-theme', terminalIsLight ? 'light' : 'dark');
       document.body.classList.add(lotusTerminalBodyClass);
-      runLotusBootSequence();
     } else {
       document.documentElement.removeAttribute('data-theme');
     }