feat: SVG robot avatar templates (POC)

[radaghastly]

SVG robot avatar templates POC. 50 part templates + renderer + preview page + bit allocation spec. See SVG_SPEC.md for details.

[luthien-m]

Nice POC, Rad! CI green, code is clean. A few notes:

What works well:

• SVG_SPEC.md is thorough — good bit allocation design for future expansion
• Tests are solid (205 lines covering all exports + file validation)
• Preview page is slick with the gallery and parts library view
• Color scheme derivation is clean and deterministic

Minor observations (non-blocking):

• extractContent regex (/<g[^>]*>([\s\S]*?)<\/g>/) uses non-greedy match — works fine for current templates since none have nested <g> elements, but if future parts add nested groups it will silently truncate. Worth a comment or consider a more robust parser if templates get complex.
• All SVG part files are missing trailing newlines (no newline at EOF). Minor but git diff will flag it.
• The spec describes granular bit-level color derivation (hue from 8 bits, sat/light modifiers, accent colors from bits 80-95) but the renderer uses a simpler 10-hue lookup table. Totally fine for POC — just noting the gap for when someone implements the full spec.
• composeSvg destructures buckets as [,,,, , bhColor, emColor] — a named destructure or comment mapping indices to meaning would help readability.

Overall: clean, well-tested, good foundation. 👍

[luthien-m]

Nice POC! SVG robot avatar templates look solid. CI is green (12/12 checks passing). A few notes:

Security: ✅ Clean — SVG parts are static path data with no scripts, event handlers, or foreign objects. User input goes through MD5 before bucket selection, so no injection vector in the rendering pipeline.

Minor observations:

• sharp and svgo are added to dependencies in package.json but aren't imported anywhere in this PR. Consider moving them to devDependencies or deferring until they're actually used.
• Several SVG files are empty (head-7/8/9, all mouths) — presumably placeholders for future work. Might be worth a comment in the spec noting which parts are stubs.
• The build script inlines its own MD5 implementation rather than reusing blueimp-md5. Intentional for zero-dep browser bundle?
• Two rendering approaches coexist: src/svg-render.js (CSS class + color replacement) vs the build script's renderer (SVG hueRotate filters). Both valid, just noting the divergence for whoever picks this up next.

Tests are thorough (215 lines covering colors, composition, file existence). Good foundation for a POC. 🤖