refactor: build CSS and HTML by interpolation instead of String(format:)

[NuPlay]

Stacked on #85. Review the last commit only; base retargets to main automatically once that merges.

Problem

The CSS and HTML templates are printf format strings rendered with String(format:), which treats % as the start of a conversion. CSS is full of literal percent signs, so every one of them has to be written %% - and forgetting one is silent.

That single choice has now produced three separate defects:

defect	cause
images not constrained to the web view width (#76)	imageCSS missing its escapes, so max-width: 100% shipped as max-width: 100 - an invalid length the browser drops. Reported December 2025
iframeCSS reading 32 bits of a 64-bit Int	%d instead of %ld
a test needed just to pin down argument order	htmlTemplate took seven positional arguments and nothing enforced their order

The regression test added in #81 exists only to police a footgun the code creates for itself.

Changes

Interpolated builders replace the format strings:

// before
public static let imageCSS = "img{... max-width: 100%%; ... border-radius: %@px;}"
String(format: RichTextConstants.imageCSS, "\(imageRadius)")

// after
public static func imageCSS(radius: CGFloat) -> String {
    "img{height:auto; max-width: 100%; width:auto;margin-bottom:5px; border-radius: \(radius)px;}"
}

All three classes disappear at once: percent signs are literal, the compiler checks the types, and arguments are named. The container id and the two script message handler names are constants inside htmlDocument(css:body:), so five of those seven positional arguments no longer exist.

The seven format strings stay as deprecated public API and still work for anyone using them directly.

Verification

Each builder was rendered and diffed against the format string it replaces:

imageCSS	identical
textCSS	identical
iframeCSS	identical
linkCSS	identical
cssTemplate	identical
mediaCSSTemplate	identical
htmlTemplate	identical (3376 vs 3376 chars)

All seven produce byte-identical output. The generated document was additionally re-checked in a browser for JS syntax, and the <details> height resync from #78 was re-run against it: 91px collapsed, 165px open, matching the measured element height.

The format-string scanner test is removed along with its subject - it policed a footgun that no longer has a live call site. Assertions on the generated output are kept.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.