Replace browser alerts with toast notifications

[paullizer]

Summary

• add a shared, accessible, XSS-safe showToast() utility for classic, inline, and module scripts
• replace all 254 executable first-party alert() calls across admin, group, public, workspace, profile, feedback, safety, and control-center flows
• persist success toasts across immediate reloads/navigation and preserve legacy error variant behavior
• add functional source-policy coverage, Playwright browser coverage, version 0.250.102, and release notes

Validation

• python functional_tests/test_browser_alert_replacement.py
• python -m pytest ui_tests/test_shared_toast_notifications.py -q
• node --check for all changed JavaScript files
• revision-scoped scripts/check_xss_sinks.py for all changed browser files
• staged whitespace and diff checks

Scope

Pinned DataTables vendor bundles are intentionally unchanged; their upstream internal fallback alerts are excluded from the first-party regression policy.

Closes #739