fix: element selector annotation not working inside form tags (gh-127) (#140)

* fix: element selector annotation not working inside form tags (gh-127)

- Remove element.closest('form') blanket rejection that blocked all elements
  inside form subtrees, making the selector unusable on SvelteKit/Next.js
  sites and localhost dev servers
- Fix dead-code password check: reorder before blanket <input> check and
  switch from getAttribute('type') to live element.type property for
  dynamically-changed input types
- Add <select>, <datalist>, <output> to sensitive-element blocklist
- Add ARIA widget role heuristics: block role=textbox/combobox/listbox/
  spinbutton/slider/searchbox and aria-valuetext/aria-valuenow attributes
- Add TreeWalker-based getSafeTextContent() that strips descendant form-control,
  datalist, output, and contenteditable text from captured textContent,
  preventing privacy leakage of input values in container-element captures
- Split role attribute by whitespace for multi-value token support

* fix(browser): stabilize annotation overlay across tab/project switches

Annotation hover/capture intermittently stopped working after switching
browser tabs or projects: the panel stayed active but the overlay was gone.
Root cause was a three-way desync between the renderer's injectedModeRef,
Rust's annotation_injected map, and the live webview DOM overlay.

- BrowserPanel: replace the cancellation-flag effect with a serialized
  reconciler (desiredModeRef + a single promise chain) so a hide's remove
  always settles before a later show's inject; converges actual->desired
  and preserves rollback-on-mode-switch-failure.
- browser_tab_manager: remove_annotation_overlay always runs the
  self-guarded JS cleanup when a webview exists (no longer skipped by a
  navigation-invalidated map); logs webview-lookup errors instead of
  swallowing them as success.
- annotation-overlay.js: IIFE reconciles (tears down + rebuilds) instead
  of silently bailing when a layer exists; snapshots/restores mode+tab
  globals around teardown and sweeps any leftover layer node.
- Add jsdom regression tests for reconcile and lifecycle serialization.

gh-127 sensitive-element logic untouched.