Prototype unknown and allowed CSS prefix checks

[gregjotau]

Why

Unused CSS is only half the loop. A class in HTML that CSS never defines is a silent visual bug. Restricting which prefixes may appear on class also makes the check small enough to fail later.

Stacked on #34.

What

• cssClassPrefixes (default r-, thim-): HTML class / th:class tokens with these prefixes must exist in first-party CSS, or they are reported as unknown
• cssAllowedPrefixes (default empty / off): if set, any other class token is disallowed
• failOnUnknownCss / failOnDisallowedCssPrefix default off
• Standalone: --prefixes=r-,thim- --allowed=r-,wa-,htmx-

Unknown is taken only from HTML class attributes, so ids, custom elements (<r-date-picker>), CSS variables, and JS hook strings are not flagged.

thim {
    cssClassPrefixes.set(listOf("r-", "thim-"))
    cssAllowedPrefixes.set(listOf("r-", "wa-", "htmx-"))
    // failOnUnknownCss.set(true)
    // failOnDisallowedCssPrefix.set(true)
}

After adding the missing ReAI utilities, that app still has ~21 unknown r-* class attributes; those are hooks/component names, not utilities.

[gregjotau]

Closing as superseded in part by #46. Exact dead-selector detection and exact runtime-class allowlisting shipped. Unknown-class/prefix enforcement is intentionally not included: consumer validation exposed legitimate generated/framework hook names and too many false positives for a strict default. That idea needs a semantic source-aware design before revival.