security: harden CSP, add path traversal protection, improve accessibility

Security fixes:
- Remove external CDN sources from CSP (cdn.jsdelivr.net, cdnjs.cloudflare.com)
- Add path validation functions to prevent path traversal attacks
- Block access to sensitive system directories
- Add isPathAccessible() check for file operations

UI/Accessibility fixes:
- Increase tab close button from 16px to 24px for better touch targets
- Add focus-visible styles for keyboard navigation
- Add ARIA labels to all toolbar buttons
- Add aria-hidden="true" to decorative SVG icons
- Add role="tablist" and role="tab" to tab bar
- Fix duplicate font-size declaration in .preview-content

Reports generated:
- Security vulnerability scan (10 findings)
- STRIDE threat model with MITRE ATT&CK mapping
- Comprehensive UI design review (40 issues)

Amit Haridas

src/styles.css

@@ -67,13 +67,14 @@ body {
     cursor: pointer;
     padding: 0;
     margin-left: 8px;
-    width: 16px;
-    height: 16px;
+    width: 24px;
+    height: 24px;
     display: flex;
     align-items: center;
     justify-content: center;
-    border-radius: 3px;
+    border-radius: 4px;
     color: #666;
+    transition: background 0.15s, color 0.15s;
 }
 
 .tab-close:hover {
@@ -81,6 +82,11 @@ body {
     color: #000;
 }
 
+.tab-close:focus-visible {
+    outline: 2px solid #5661b3;
+    outline-offset: 2px;
+}
+
 .new-tab-button {
     background: none;
     border: 1px solid #ccc;
@@ -96,6 +102,11 @@ body {
     background: #e8e8e8;
 }
 
+.new-tab-button:focus-visible {
+    outline: 2px solid #5661b3;
+    outline-offset: 2px;
+}
+
 /* Tab Content */
 .tab-content {
     display: flex;
@@ -139,6 +150,11 @@ body {
     background: #d0d0d0;
 }
 
+.toolbar button:focus-visible {
+    outline: 2px solid #5661b3;
+    outline-offset: 2px;
+}
+
 .toolbar-group {
     display: flex;
     align-items: center;
@@ -225,7 +241,6 @@ body {
     margin: 0;
     padding: 20px 24px 24px 24px;
     line-height: 1.6;
-    font-size: 15px;
     font-size: 14px;
 }