fix(security): CSP IPC para macOS + sanitización SVG del informe clínico

[AtelierMinuit]

Summary

• Audited the app (Tauri v2 + React 19, macOS desktop target): typecheck, build, and tests all pass; Rust backend is solid (path validation, atomic writes, size limits).
• fix (crítico, macOS): tauri.conf.json CSP now includes ipc: http://ipc.localhost in connect-src. Without it, macOS WKWebView blocks invoke() and the SQL plugin, breaking open/save .trama and the local database.
• fix (seguridad): ClinicalReportModal sanitizes the ecomap SVG with DOMPurify before dangerouslySetInnerHTML. schematex does not escape user-controlled labels, so an imported .trama file could inject arbitrary markup (XSS) into the clinical report view.
• Declared dompurify as a direct dependency (it was already in the tree via jspdf's optional deps, so no new packages added).

Verification

• npx tsc --noEmit ✅
• pnpm build ✅
• pnpm test — 4 files / 9 tests passed ✅
• cargo check fails only in this Linux sandbox due to missing system glib/pkg-config; the macOS build workflow (tauri-build.yml) is unaffected.

UX / Dark mode audit (2nd pass)

• fix (UX): Editor zoom pill used a non-existent CSS class (zoom-pill-label) so it rendered unstyled, and always showed a static "100%". Now it uses the real .zoom-pill-value class and displays the live zoom level via onViewportChange (clicking it still fits to screen).
• fix (tema): The "Monocromo" option in Settings had no visual effect: its CSS variables only existed in the legacy App_old.css, which is no longer imported. Restored .theme-monochrome / .theme-dark.theme-monochrome variables in App.css.
• Dark mode audit: the modern workspace components correctly use CSS variables that switch with theme-dark; connection lines and node colors have adequate contrast in both themes. The clinical report intentionally stays light (A4 printing).
• Verified: tsc --noEmit ✅, pnpm build ✅, pnpm test 9/9 ✅

Technical debt audit (3rd pass)

• Removed dead code (~1026 lines): 6 one-shot patch_*.cjs scripts from past redesigns (already applied; re-running them would corrupt current sources), src/App_old.css (35 KB, no longer imported), and unreferenced docs/assets/screenshots/dummy_state.json.
• CI now runs the test suite: ci.yml previously only built — the 9 existing tests were never validated on PRs. Added pnpm test step and --frozen-lockfile install.
• Verified: tsc --noEmit ✅, pnpm build ✅, pnpm test 9/9 ✅, YAML valid ✅