feat(ui): highlight source server-side with a near-monochrome Shiki theme (CG-43)

The viewer's code block stops lexing with a hand-rolled dialect table and
reads real TextMate grammars instead, run once in `/api/source`.

Three things make that safe to depend on:

* Highlighting never fails a request. A missing grammar, an oversized
  slice, an ESM import that did not resolve — every one of them answers
  `engine: 'plain'` with a reason and the source still goes out.
* Identifiers survive whatever token boundaries a grammar chose. Every
  code token is split into identifier runs before it goes on the wire, so
  the graph's call-site overlay claims a token the highlighter produced
  rather than re-cutting the line. `assignRefs` now matches on a token's
  text rather than on the class a grammar gave it, so a language that
  scopes type names as `storage.type` still links.
* The theme classifies rather than colours: its foregrounds are sentinels
  the server maps back to class names, and the viewer paints them from
  CSS custom properties — one token stream serves light and dark with no
  refetch, and the ramp lives only in app.css.

Comments move from --ink-3 to a new --code-comment. --ink-3 measures
3.46:1 on paper and 3.00:1 on the hot-line tint, both under AA for 12.5px
text; --code-comment is the smallest step along the same ramp that clears
4.5:1 on every background a code line can have, and stays quieter than
the strings and numbers above it.

Shipping: @shikijs/core and @shikijs/engine-javascript are runtime
dependencies (no wasm, no native module); @shikijs/langs stays a
devDependency and `npm run build:textmate` writes only the closure the
engine's 40-odd languages reach — 56 grammars, 2.6 MB, against 11 MB for
all 722. check-ui-build.mjs asserts the tree after every build and inside
every release archive.

ui/src/views/SymbolView.svelte

@@ -23,6 +23,7 @@
   import SourceBlock from '../components/symbol/SourceBlock.svelte';
   import SymbolHeader from '../components/symbol/SymbolHeader.svelte';
   import { ApiFailure, fetchSource, fetchSymbol, type WireNodeRef, type WireSource, type WireSymbolPayload } from '../lib/api';
+  import { tokensByLine, type Token } from '../lib/highlight';
   import { hot, railFocus } from '../lib/focus.svelte';
   import { project } from '../lib/project.svelte';
   import {
@@ -148,6 +149,18 @@
     return buildCodeBlock(from, source.lines, graphCallLines(payload));
   });
 
+  /**
+   * Classified source by file line, from `/api/source`.
+   *
+   * Keyed by real file line rather than by window offset, because a windowed
+   * body renumbers nothing: the gaps are holes in the same numbering, and the
+   * code block looks a line up by the number it prints in the gutter.
+   */
+  let codeTokens = $derived.by(() => {
+    if (!source?.lines) return new Map<number, Token[]>();
+    return tokensByLine(source.lines, source.from ?? 1, source.highlight);
+  });
+
   let origin = $derived(arrivedFrom());
   let originLeft = $derived(origin?.rail === 'left' ? origin.id : null);
   let originRight = $derived(origin?.rail === 'right' ? origin.id : null);
@@ -432,7 +445,7 @@
           {:else if codeBlock}
             <SourceBlock
               block={codeBlock}
-              language={payload.node.language}
+              tokens={codeTokens}
               {refs}
               defLine={payload.node.line}
               defName={payload.node.name}