fix(documents): address review cycle 2 — a11y, CSS injection, debounce tests

- ContributorStack: text-xs for WCAG 1.4.4 (was text-[10px]), safeColor()
  validation to block CSS injection via actor.color, role="img" aria-label
  on empty placeholder, {#each} keyed by index
- ContributorStack spec: update empty-state assertion to getByRole('img')
- DocumentRow spec: add stopPropagation regression test for tag click
- documents/page.svelte.spec.ts: new — debounce, URL building, initial state

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/lib/components/DocumentRow.svelte.spec.ts

@@ -145,6 +145,19 @@ describe('DocumentRow – tags', () => {
 		await page.getByRole('button', { name: 'Urlaub & Reise' }).click();
 		expect(goto).toHaveBeenCalledWith('/documents?tag=Urlaub%20%26%20Reise');
 	});
+
+	it('tag click does not navigate to the document detail page', async () => {
+		const item = makeItem({
+			document: {
+				...makeItem().document,
+				tags: [{ id: 't2', name: 'Familie', color: null, parentId: null }]
+			}
+		});
+		render(DocumentRow, { item });
+		const before = window.location.href;
+		await page.getByRole('button', { name: 'Familie' }).click();
+		expect(window.location.href).toBe(before);
+	});
 });
 
 // ─── ProgressRing & ContributorStack ─────────────────────────────────────────