fix(documents): address review cycle 2 — a11y, CSS injection, debounce tests

- ContributorStack: text-xs for WCAG 1.4.4 (was text-[10px]), safeColor()
  validation to block CSS injection via actor.color, role="img" aria-label
  on empty placeholder, {#each} keyed by index
- ContributorStack spec: update empty-state assertion to getByRole('img')
- DocumentRow spec: add stopPropagation regression test for tag click
- documents/page.svelte.spec.ts: new — debounce, URL building, initial state

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/lib/components/ContributorStack.svelte.spec.ts

@@ -45,6 +45,8 @@ describe('ContributorStack', () => {
 
 	it('renders empty placeholder when no contributors', async () => {
 		render(ContributorStack, { contributors: [], hasMore: false });
-		await expect.element(page.getByTitle('Noch niemand angefangen')).toBeInTheDocument();
+		await expect
+			.element(page.getByRole('img', { name: 'Noch niemand angefangen' }))
+			.toBeInTheDocument();
 	});
 });