Security, performance, bug fixes, and TDS improvements

Security:
- HIGH-1: Validate hex color format before CSS interpolation in sanitize.ts
- HIGH-5: Add sandbox attribute to OpenStreetMap iframe
- MED-1: Fix permissive URL scheme regex in LINKIFY_OPTS
- MED-3/HIGH-4: Add .js.map blocking + CSP header to nginx config
- LOW-2: Validate OIDC authUrl scheme before window.open
- Accessibility: Remove maximum-scale=1.0 from viewport meta (WCAG 1.4.4)

Performance:
- O(1) Map index in computePositions (was O(M×T) findIndex per member)
- Add RoomMemberEvent.Membership subscription so positions update on join/leave
- Fix uncleaned 2000ms setTimeout in RoomTimeline useLayoutEffect

Bug fixes:
- BUG-5: Add QUEUED/CANCELLED cases to DeliveryStatus component
- BUG-6: Guard DeliveryStatus against state events via isState() check
- BUG-10: Clamp PiP position on window resize
- BUG-14: Separate runLotusBootSequence into dedicated useEffect([lotusTerminal])
- Fix aria-live on typing indicator (WCAG 4.1.3)
- Add aria-label + aria-multiline to message editor

TDS (Lotus Terminal Design System):
- Add reaction chip styles (dark + light mode)
- Add GIF picker CSS via globalStyle instead of runtime injection
- Add URL preview styles (dark + light mode)
- Add complete GIF picker light-mode TDS block (was missing)

src/lotus-terminal.css.ts

@@ -686,3 +686,34 @@ globalStyle(`html[data-theme="light"] body.${lotusTerminalBodyClass} [data-url-p
   color: '#0062b8 !important' as any,
 });
 
+// ── GIF picker light TDS (dark-mode rules already exist via [data-gif-terminal]) ──
+globalStyle(
+  `html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] input,` +
+  `html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] form`, {
+  background: '#f4f6fa !important' as any,
+  color: '#111827 !important' as any,
+  border: '1px solid rgba(196,78,0,0.28) !important' as any,
+  fontFamily: "'JetBrains Mono','Cascadia Code','Fira Code',monospace !important" as any,
+  fontSize: '12px !important' as any,
+  boxShadow: 'none !important' as any,
+});
+globalStyle(`html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] input:focus`, {
+  borderColor: 'rgba(196,78,0,0.60) !important' as any,
+  boxShadow: '0 0 0 2px rgba(196,78,0,0.12) !important' as any,
+  outline: 'none !important' as any,
+});
+globalStyle(`html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] input::placeholder`, {
+  color: 'rgba(196,78,0,0.45) !important' as any,
+});
+globalStyle(`html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] svg,` +
+  `html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] button[type="reset"]`, {
+  display: 'none !important' as any,
+});
+globalStyle(`html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] ::-webkit-scrollbar-track`, {
+  background: '#e2e7ef',
+});
+globalStyle(`html[data-theme="light"] body.\${lotusTerminalBodyClass} [data-gif-terminal] ::-webkit-scrollbar-thumb`, {
+  background: 'rgba(196,78,0,0.35)',
+  borderRadius: '2px',
+});
+