fix(svg): preserve text path references

[DavidBabinec]

What changed

• preserve DOMPurify-validated href and xlink:href attributes required by inline SVG fragment references such as <textPath href="#ring">
• parse the editor canvas SVG root in the same HTML context as the published page while continuing to enforce exactly one SVG root
• add sanitizer, Super Import, and editor regressions for circular text paths and unsafe URI schemes

Why

Super Import correctly mapped the SVG element, but the shared SVG sanitizer blanket-removed both reference attributes, disconnecting <textPath> from its <path>. Once those safe references were preserved, live testing exposed a second mismatch: the canvas used strict XML parsing and rejected common inline-HTML SVG that uses xlink:href without an explicit namespace declaration. Published pages parse that markup as HTML, so the canvas now matches the real rendering context.

Impact

Circular SVG text now survives Super Import, editor save/reload, responsive canvas rendering, and publish. DOMPurify remains responsible for URI-scheme validation, and script, foreignObject, nested anchors, JavaScript URIs, and data-URI <use> payloads remain blocked.

Verification

• bun test — 6,279 passed, 0 failed
• focused SVG/import/editor suites — 154 passed, 0 failed
• bun run lint
• bun run build
• live Chrome audit from a fresh disposable install: imported the reported seal fixture through Super Import, verified the text and both fragment references at mobile/tablet/desktop canvas widths, saved and reloaded, published through the UI, and verified the same animated circular text on the anonymous /seal page