fix(security): harden browser security boundaries

Reject unsafe metric ledger keys, keep email HTML inspection inert, and construct gallery thumbnails structurally. Add adversarial browser regressions for the remaining CodeQL security boundaries.

tests/test_codeql_security_js.py

@@ -15,3 +15,16 @@ def test_codeql_security_browser_contracts():
         "chat": True, "markdown": True, "svg": True,
         "menus": True, "admin": True, "bootstrap": True,
     }
+
+
+def test_pr6503_ledger_email_and_gallery_security_contracts():
+    root = Path(__file__).resolve().parents[1]
+    result = subprocess.run(
+        ["node", "tests/pr6503_security_browser.cjs"], cwd=root,
+        capture_output=True, text=True, timeout=60,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert json.loads(result.stdout) == {
+        "ledger": True, "email": True, "gallery": True, "links": True, "skills": True,
+        "sanitizer": True, "print": True,
+    }