fix(studio-server): prevent inline-image preview tracking OOM

[miguel-heygen]

What

Prevents the Desktop launch crash caused by tracking an inlined background image as a filesystem path.

Why

An entity-quoted CSS URL such as url("data:image/png;base64,...") bypasses the scheme check. Every slash in the base64 then triggers filesystem and ancestor tracking, consuming memory until the app crashes.

Related work

Fixes #5097. Delivery requires an OSS release followed by the Desktop package update.

How

Use the existing HTML parser to decode actual attributes, while keeping stylesheet and script text literal. Reject non-file URLs and bound decoded and resolved filesystem paths before walking them. Local assets, query strings, percent escapes, symlinks and nested templates keep their preview tracking.

Test plan

• Seven regressions added; the original three failed on the old helper. All 107 preview tests pass against the fresh workspace build.
• Actual helper scanned 14.4 MB of HTML containing twelve 1.2-million-character inline URLs under a 128 MiB heap limit: 432 ms, 62.3 MiB heap used. No data URL was tracked as a path.
• Workspace build, package typecheck, lint, formatting and normal pre-commit checks pass.
• Packaged macOS Desktop acceptance; this Linux verification exercises the preview server and helper.
• Comments explain the path bound and HTML/raw-text distinction. No documentation change needed.

[github-actions]

Edit accuracy: accurate 2055 (base branch 2055), smooth 1656 of those

The gate passes.
Smoothness is reported in the artifact, not gated. A case fails only if it fails 2 of 3 runs.

Quarantined, measured but not gated (0)

Unstable (1)

• seqplainkeys-none-px-r30-nested-z100: tracking 236, pressJump 0, drop 0, reload 0, render 0.07, renderKey -, undo true, teleport false / tracking 0.27, pressJump 0, drop 0, reload 0, render 0.07, renderKey -, undo true, teleport true / tracking 0.27, pressJump 0, drop 0, reload 0, render 0.07, renderKey -, undo true, teleport true