V9: Sync-status dashboard route in `apps/stacker`

[ckrough]

Complexity: L

Scope

Rebuild the sync-status view as a SvelteKit route (Svelte 5 runes, Skeleton UI v4) in apps/stacker, consuming the #310 API and the shared packages/design-system/ tokens (consistent with the grader view living in stacker).

• Render the animal x channel table with in_sync / stale / missing states (color-banded).
• Show current-vs-live version per row.
• Drill-in per animal showing the normalized text diff.
• Security: the live listing content is untrusted. HTML/attribute-escape all interpolated content, and validate http(s) scheme on any URL before it becomes an href.

Dependencies

• Blocked by: V8: Typed, authed, org-scoped API serving the compliance table #310 (the typed API).
• Blocks: none.

Acceptance criteria

• Rendered against a fixture API response, the table shows one row per animal x channel with the correct status band/class (component test asserts states).
• A stale row exposes a drill-in that renders the text diff (test).
• Interpolated listing copy is HTML-escaped and a javascript: / <script> payload is neutralized (test).
• The page makes no request to an external host (design-system tokens are vendored; a build or test check asserts no external asset URLs).

---

ADR: docs/adr/0033-listing-sync-verification.md. Epic: #302.