Full: add safe lazy YAML frontmatter metadata cards

[trsdn]

Goal

Recognize YAML frontmatter and present useful metadata in Full without burdening Lite or treating untrusted YAML as executable data.

Requirements

• Bundle a pinned js-yaml build only in Full and load it only when a document starts with a valid frontmatter delimiter.
• Use a safe restricted schema with no custom tags, constructors, functions, or implicit executable values.
• Apply strict source-size, nesting-depth, alias/collection, and displayed-entry limits before and after parsing.
• Render metadata through DOM APIs as a compact, collapsible card; never interpolate YAML into HTML.
• Support scalar values, bounded lists, and bounded maps with deterministic formatting.
• Keep malformed frontmatter recoverable: show a concise parse error and preserve editable source and preview body.
• Ensure frontmatter is not rendered twice as Markdown content.
• Update live preview predictably and style cards for every palette and printing.
• Include exact version, checksum, MIT notice, and required transitive notices.

Acceptance criteria

• Documents without frontmatter never load js-yaml.
• Unsafe tags, prototype-related keys, alias bombs, deep nesting, and oversized metadata are rejected safely.
• Lite contains no js-yaml assets.

[trsdn]

Implemented and released in MDViewer+ v2.0.0.