Add client-side syntax highlighting for code blocks in lessons

[ebouchut]

This PR adds client-side syntax highlighting for code blocks in lessons.
It uses a pinned, self-hosted highlight.js bundle.

Why

Fenced code blocks in lessons are rendered monochrome, even though the
renderer has emitted code class="language-java" since ADR-0013, where
the sanitizer deliberately kept the class on code "for a future
syntax highlighter".
This PR adds the highlighter.

How

Client-side highlighting on the same pattern as the Mermaid feature
(ADR-0016: the server keeps shipping sanitized, text-only code blocks
and the browser upgrades them. Decision recorded in
ADR-0017.

• docs(plan): implementation plan
  (docs/plans/2026-07-31-lesson-syntax-highlighting.md)
• docs(adr): ADR-0017, highlight.js over Prism, a server-side
  highlighter, or nothing
• build(deps): pinned org.webjars.npm:highlightjs__cdn-assets
  11.11.1, zero transitives. The cdn-assets artifact is deliberate:
  since v11 the plain highlight.js WebJar ships only bundler modules
  and no browser build
• feat(frontend): lesson-highlight.js loads the bundle lazily, only
  when the lesson contains a language-* fence other than
  language-mermaid, and highlights only languages the bundle knows;
  unknown hints and bare fences stay monochrome by design (no
  auto-detect guessing). Token colors map to the existing surface-safe
  accent tokens, so both themes pass WCAG AA with no vendor CSS to fork

Verification

• Full test suite (78) and Checkstyle green. The existing renderer test
  pinning language-java survival through sanitization is untouched.
• Verified in the browser on a seeded lesson: java, python, sql, and
  bash fences gain colored tokens in both themes; an unknown-language
  fence and a bare fence stay monochrome; a mermaid fence is skipped by
  the highlighter and still renders as a diagram; axe (WCAG 2.1 A/AA)
  reports zero violations in both themes; no horizontal page scroll.

Note

No sanitizer, renderer, or cache change: the whole diff is one JS
file, one CSS block, one dependency, two template lines, and docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.71%. Comparing base (da15d16) to head (4342f95).

Additional details and impacted files

@@            Coverage Diff            @@
##                dev     #130   +/-   ##
=========================================
  Coverage     81.71%   81.71%           
  Complexity      202      202           
=========================================
  Files            38       38           
  Lines           864      864           
  Branches         53       53           
=========================================
  Hits            706      706           
  Misses          124      124           
  Partials         34       34           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.