refactor(mcp-server): make the diagram modules usable from the web app

The web app will reuse the MCP server's XML engine instead of its own
copy in lib/utils.ts, so these modules now run in the browser too.

- Relative imports end in .ts, rewritten to .js by tsc
  (rewriteRelativeImportExtensions); Next.js resolves them directly
- Every module uses the global DOMParser/XMLSerializer: native in the
  browser, linkedom in Node via installDomPolyfill. pages.ts parsed with
  linkedom but serialized with the global serializer, which throws in
  the browser
- The saxes syntax check moves to xml-syntax.ts, so the browser does not
  pull in linkedom; it now also rejects undeclared prefixes such as
  xlink:, as the browser does
- Page decompression uses pako and atob instead of node:zlib and Buffer
- hasCells moves to pages.ts, away from the file system code
- The duplicate cell id check counts UserObject/object ids
- wrapCellsInModel drops comments and text before the first cell, which
  the web app accepts today
- validateAndFixXml takes { strict: false } for diagrams with user content
- Web tests run these modules with a browser DOM (jsdom)
- saxes becomes a direct dependency of the web app

packages/mcp-server/src/xml-syntax.ts

@@ -0,0 +1,21 @@
+/**
+ * Strict XML syntax check, used in Node and in the web app's browser code.
+ * saxes reports syntax errors the way draw.io's DOMParser will, including
+ * an attribute prefix such as xlink: that was never declared.
+ */
+import { SaxesParser } from "saxes"
+
+/**
+ * Returns the first XML syntax error as "line:column: message", or null if
+ * the XML is well-formed. Surrounding whitespace is ignored because every
+ * caller trims before the XML reaches the browser.
+ */
+export function getXmlSyntaxError(xml: string): string | null {
+    let error: string | null = null
+    const parser = new SaxesParser({ xmlns: true })
+    parser.on("error", (err) => {
+        error ??= err.message
+    })
+    parser.write(xml.trim()).close()
+    return error
+}