fix: restore inline diagram controls and synchronize portal theme

scripts/viewer-theme-bridge.js

@@ -0,0 +1,21 @@
+// Sandboxed viewers have opaque origins: authenticate the sender by WindowProxy,
+// not origin. Only exchange a validated theme, never HTML, URLs or commands.
+(() => {
+  if (window.parent === window) return;
+  let connected = false;
+  window.addEventListener('message', event => {
+    if (event.source !== window.parent || event.data?.type !== 'eldorado:set-theme') return;
+    const theme = event.data.theme;
+    if (theme !== 'light' && theme !== 'dark') return;
+    connected = true;
+    if (document.documentElement.dataset.theme !== theme) {
+      document.getElementById('btn-theme').click();
+      // Parent updates are not new user choices; do not echo stale acknowledgements.
+      observer.takeRecords();
+    }
+  });
+  const observer = new MutationObserver(() => {
+    if (connected) window.parent.postMessage({type: 'eldorado:theme', theme: document.documentElement.dataset.theme}, '*');
+  });
+  observer.observe(document.documentElement, {attributes: true, attributeFilter: ['data-theme']});
+})();