refactor(js): extract favicon module + add faviconHost tests (§3.1)

Sixth slice of the app.js split. Moves the favicon fetch/cache section
(faviconHost, saveEntryIcon, ensureEntryFavicon, backfillFavicons,
clearAllFavicons) to js/app.favicon.js. Pure declarations, no top-level
side effects → loads before app.js.

- Code moved byte-for-byte; no duplicate const; syntax OK on all 7 app parts.
- NEW: js/tests/favicon.test.js — 7 tests for faviconHost, the pure
  URL→validated-hostname function that decides which domain is sent to the
  DuckDuckGo proxy (a bug there leaks the wrong host). Covers scheme/www/
  path/port stripping, non-hostname rejection, malformed dotting, unsafe
  chars, and the 253-char DNS cap.
- Fixed an inaccurate source comment surfaced by the tests: it claimed raw
  IPs "stay valid", but the TLD rule /\.[a-z]{2,}$/ rejects a numeric final
  label, so IPs get no favicon lookup (fine). Test pins the real behaviour.
- Suite: 55 → 62 tests, all green. Assets regenerated (8 ordered JS files).

app.js: 11936 → 9790 lines (6 modules extracted).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

delphi-backend/assets/BuildAssets.ps1

@@ -54,6 +54,7 @@ $patterns = @(
     'js\argon2.js',
     'js\app.crypto.js',
     'js\app.totp.js',
+    'js\app.favicon.js',
     'js\app.import.js',
     'js\app.backup.js',
     'js\app.js',

delphi-backend/assets/assets.inc

@@ -1,11 +1,12 @@
 // Auto-generated by BuildAssets.ps1 - do not edit by hand.
 const
-  EMBEDDED_ASSET_COUNT = 9;
+  EMBEDDED_ASSET_COUNT = 10;
   EMBEDDED_ASSETS: array[0..EMBEDDED_ASSET_COUNT-1] of TEmbeddedAsset = (
     (UrlPath: '/index.html'; ResName: 'INDEX_HTML'),
     (UrlPath: '/js/argon2.js'; ResName: 'JS_ARGON2_JS'),
     (UrlPath: '/js/app.crypto.js'; ResName: 'JS_APP_CRYPTO_JS'),
     (UrlPath: '/js/app.totp.js'; ResName: 'JS_APP_TOTP_JS'),
+    (UrlPath: '/js/app.favicon.js'; ResName: 'JS_APP_FAVICON_JS'),
     (UrlPath: '/js/app.import.js'; ResName: 'JS_APP_IMPORT_JS'),
     (UrlPath: '/js/app.backup.js'; ResName: 'JS_APP_BACKUP_JS'),
     (UrlPath: '/js/app.js'; ResName: 'JS_APP_JS'),

delphi-backend/assets/assets.rc

@@ -5,6 +5,7 @@ INDEX_HTML RCDATA "Z:\\password-manager\\index.html"
 JS_ARGON2_JS RCDATA "Z:\\password-manager\\js\\argon2.js"
 JS_APP_CRYPTO_JS RCDATA "Z:\\password-manager\\js\\app.crypto.js"
 JS_APP_TOTP_JS RCDATA "Z:\\password-manager\\js\\app.totp.js"
+JS_APP_FAVICON_JS RCDATA "Z:\\password-manager\\js\\app.favicon.js"
 JS_APP_IMPORT_JS RCDATA "Z:\\password-manager\\js\\app.import.js"
 JS_APP_BACKUP_JS RCDATA "Z:\\password-manager\\js\\app.backup.js"
 JS_APP_JS RCDATA "Z:\\password-manager\\js\\app.js"