fix(review): cycle 3 — a11y, CSS injection, domain boundary

- DocumentRow: add data-testid="search-snippet"; sanitize tag.color with safeTagColor()
- ContributorStack: add role="img" aria-label to overflow "…" badge
- DocumentList: year header text-[10px] → text-xs (WCAG 1.4.4 minimum 12px)
- DashboardResumeStrip: sanitize collab.color with safeColor()
- Extract TranscriptionBlockQueryService to fix cross-domain repository access in DocumentService
- Update unit test mocks to use TranscriptionBlockQueryService

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/lib/components/DocumentRow.svelte

@@ -29,6 +29,10 @@ function tagClass(matched: boolean): string {
 		? 'inline-flex items-center gap-1 rounded px-2 py-1.5 text-xs font-bold tracking-widest uppercase bg-primary text-primary-fg transition-colors'
 		: 'inline-flex items-center gap-1 rounded px-2 py-1.5 text-xs font-bold tracking-widest uppercase bg-muted text-ink hover:bg-primary hover:text-primary-fg transition-colors';
 }
+
+function safeTagColor(color: string | null | undefined): string {
+	return color && /^#[0-9a-fA-F]{6}$/.test(color) ? color : '#cdcbbf';
+}
 </script>
 
 <li class="group transition-colors duration-200 hover:bg-muted/50">
@@ -52,7 +56,10 @@ function tagClass(matched: boolean): string {
 
 				<!-- Snippet -->
 				{#if snippetSegments}
-					<p class="mb-2 line-clamp-2 font-sans text-sm text-ink-2 italic">
+					<p
+						data-testid="search-snippet"
+						class="mb-2 line-clamp-2 font-sans text-sm text-ink-2 italic"
+					>
 						{#each snippetSegments as seg, i (i)}
 							{#if seg.highlight}
 								<mark
@@ -117,7 +124,9 @@ function tagClass(matched: boolean): string {
 								onclick={(e) => { e.stopPropagation(); goto('/documents?tag=' + encodeURIComponent(tag.name)); }}
 							>
 								{#if tag.color}
-									<span class="h-1.5 w-1.5 rounded-full" style="background-color: {tag.color};"
+									<span
+										class="h-1.5 w-1.5 rounded-full"
+										style="background-color: {safeTagColor(tag.color)};"
 									></span>
 								{/if}
 								{tag.name}