fix(review): cycle 3 — a11y, CSS injection, domain boundary

- DocumentRow: add data-testid="search-snippet"; sanitize tag.color with safeTagColor()
- ContributorStack: add role="img" aria-label to overflow "…" badge
- DocumentList: year header text-[10px] → text-xs (WCAG 1.4.4 minimum 12px)
- DashboardResumeStrip: sanitize collab.color with safeColor()
- Extract TranscriptionBlockQueryService to fix cross-domain repository access in DocumentService
- Update unit test mocks to use TranscriptionBlockQueryService

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/DocumentList.svelte

@@ -74,7 +74,7 @@ const yearGroups = $derived.by(() => {
 			class="mb-4 overflow-hidden border border-line bg-surface shadow-sm"
 		>
 			<div class="border-b border-line bg-muted px-5 py-2">
-				<span class="font-sans text-[10px] font-bold tracking-widest text-ink-3 uppercase"
+				<span class="font-sans text-xs font-bold tracking-widest text-ink-3 uppercase"
 					>{group.year}</span
 				>
 			</div>