Pre-alpha3 audit: refuse operator markup and scripted artwork on the place map, take the summary off its per-line reads, and put back the vocabulary, translations and docs the last 92 commits moved

Fixes the findings of the pre-alpha3 audit, as one release-preparation change.

Security. The venue's sprite ids are constrained to an XML id and the map builds the place glyph as elements rather than as markup, so an operator-entered value can no longer close an attribute and add its own. The background illustration is refused when it carries a script, an event handler, an element that can load something, an executing URL or a reference to another document; the rule lives in MapBackgroundSvg and is asked on both write paths, by the venue form through the YoyakuUnscriptedSvg field constraint and by the package importer before it writes anything.

Performance. TransactionSummary::build() primes the slots, resources and tariffs its lines point at, one read each, so the reference reads that follow are answered from the entity static cache. Measured with Database::startLog() around build() with cold entity caches: 7 queries for one line, 22 for four and 62 for twelve, against 7 for all three. The conditions are unchanged, and the built events and tickets are identical.

Accessibility. The pooled-area steppers mark a reached bound with aria-disabled and make the handler a no-op, instead of setting disabled and dropping the keyboard user's focus at the exact moment they reach the maximum. The CSS follows the attribute.

Vocabulary. sell, sold, sale and their French are gone again, from the resource field now labelled Offers by tariff down to the docblocks and test names, and offersByTariff() replaces sellsByTariff().

Translations. 45 strings added to fr.po and 40 orphans removed. Verified with potx in both directions: 0 missing, 0 untranslated, 0 orphaned.

Documentation. docs/metrics.md regenerated (683 files / 72,118 lines to 1,015 / 109,705), twelve pre-release-history passages across eight pages rewritten as the current design, the no-code page added to the navigation, yoyaku_booking_fee and yoyaku_calendar_interaction added to the module map.

Also. VenueMapBuilder::mergePools() and the docblock pointing at it are gone; so is the map's branch injecting a venue.background no PHP has emitted since the artwork became its own resource. Five unused assignments dropped from a test, #[RunTestsInSeparateProcesses] added to the 15 classes lacking it, and the composer suggest block now names the four Drupal projects the shipped submodules depend on.

New tests, each seen to fail against the unfixed code: VenueArtworkSafetyTest (6 methods over the sprite ids and the illustration) and three methods in VenueIoTest for the importer, including that a refused package creates nothing.

phpcs clean over the module root, phpstan clean at the CI ruleset, msgfmt --check clean, PaymentSummaryPricingTest and TariffsEnabledTest green on MySQL.