fix: restore inline diagram controls and synchronize portal theme

scripts/inline-viewer.test.mjs

@@ -0,0 +1,51 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {runInNewContext} from 'node:vm';
+const read = path => readFileSync(path, 'utf8');
+
+test('both story layouts permit downloads without weakening origin isolation', () => {
+  const wrapper = read('src/components/ArchifyDiagram/index.tsx');
+  for (const layout of ['desktop', 'mobile']) {
+    const iframe = wrapper.split(`<iframe className="story-${layout}"`)[1].split(' />')[0];
+    assert(iframe.includes('sandbox="allow-scripts allow-downloads"'));
+    assert(iframe.includes('?embed=1&theme=${initialTheme.current}'));
+  }
+  assert(!wrapper.includes('allow-same-origin'));
+});
+
+test('build adds maintained embed-only controls without changing pinned vendor', () => {
+  const build = read('scripts/build-diagrams.mjs');
+  assert(build.includes("new URL('./inline-viewer.css', import.meta.url)"));
+  assert(build.includes('eldorado-inline-controls'));
+  const css = read('scripts/inline-viewer.css');
+  assert(css.includes('html[data-embed="true"] .toolbar'));
+  assert(css.includes('display: flex !important'));
+  assert(css.includes('position: relative'));
+  assert(css.includes('max-height: calc(100vh - 52px)'));
+});
+
+test('theme bridge rejects unrelated senders/values and never echoes parent updates', () => {
+  const root = {dataset:{theme:'light'}};
+  let receive, observerCallback, mutations = 0;
+  const messages = [];
+  const parent = {postMessage: message => messages.push(message)};
+  const window = {parent, addEventListener: (type, callback) => {receive = callback;}};
+  const button = {click: () => {root.dataset.theme = root.dataset.theme === 'light' ? 'dark' : 'light'; mutations++;}};
+  class MutationObserver {
+    constructor(callback) {observerCallback = callback;}
+    observe() {}
+    takeRecords() {mutations = 0;}
+  }
+  runInNewContext(read('scripts/viewer-theme-bridge.js'), {window, document:{documentElement:root, getElementById: () => button}, MutationObserver});
+  const send = (source, theme) => receive({source, data:{type:'eldorado:set-theme', theme}});
+  send({}, 'dark'); send(parent, 'invalid');
+  assert.equal(root.dataset.theme, 'light');
+  send(parent, 'dark');
+  assert.equal(root.dataset.theme, 'dark');
+  assert.equal(mutations, 0);
+  assert.equal(messages.length, 0);
+  button.click(); observerCallback();
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0].theme, 'light');
+});