feat: support safe inline SVG widgets

[daniel-lxs]

Summary

• allow static inline SVG through the widget sanitizer using DOMPurify's SVG profile
• preserve chart primitives such as shapes, paths, text, gradients, and clipping
• strip active or externally loaded SVG features, including animation, filters, embedded HTML, images, and external references
• tell agents which SVG features are supported and keep canvas unsupported
• cover safe chart markup and malicious SVG payloads with focused tests

Security boundary

Widgets remain scriptless and network-isolated. The iframe CSP continues to use default-src 'none', while the worker sanitizer removes executable attributes and unsafe SVG elements or references before persistence.

Validation

• mise exec -- pnpm --filter @roomote/worker exec vitest run src/mcp/roomote-mcp-server/__tests__/show-widget.test.ts src/mcp/roomote-mcp-server/__tests__/tool-descriptions.test.ts
• mise exec -- pnpm --filter @roomote/worker check-types
• mise exec -- pnpm --filter @roomote/worker lint

[roomote-roomote]

1 issue outstanding. See task

• apps/worker/src/mcp/roomote-mcp-server/show-widget.ts:122 — Allowing SVG while preserving arbitrary custom CSS means @keyframes, animation, and CSS filter remain active inside the iframe. Strip or reject those CSS features, or narrow the static-only/stripped-effects guidance.

_{Reviewed e769432}