fix(app): render preview backgrounds inside sandbox

[Richardpwe]

What changed

• render the selected preview background inside the opaque sandbox runner
• keep uploaded background images in a closed shadow root
• update backgrounds through the session-bound runner channel without reloading the Graphic
• bump the preview protocol to v4 and cache-bust the runner assets
• reject oversized image uploads before they reach the runner
• add Playwright coverage for checker, solid colors, image uploads, session reuse, and shadow-root isolation

Why

Chromium composites a sandboxed opaque-origin iframe onto a white top-level canvas. The parent preview background therefore remained hidden even though the picker state and parent styles changed correctly.

Impact

Transparent Graphics now show the selected background. The iframe remains sandbox="allow-scripts" without same-origin access, and background changes do not remount the Graphic or create a new preview session.

Checks

• npm run release:check
• 125 app unit tests
• 115 core tests
• 9 Playwright tests
• app/core build and core tarball smoke
• full and production npm audits: 0 vulnerabilities