style: format web/src with oxfmt defaults (via vp fmt)

One-time mechanical sweep, isolated from any functional change.
- oxfmt defaults: double quotes, semicolons, 2-space indent, LF,
  printWidth 100, trailing commas, bracket spacing, arrow parens.
- vite.config.ts gains an fmt.ignorePatterns block for web/static:
  vendored/minified assets (htmx.min.js, compiled css) must never
  be reformatted.
- Verified: rebuild after the sweep produces byte-identical JS/CSS
  bundles; only sourcemaps changed (they embed sourcesContent).

web/src/annotations-banner.ts

@@ -43,7 +43,10 @@ interface AnnotationSource {
 }
 
 /** Friendly human location label; mirrors the app's positionHint(). */
-function friendlyAnnotationLabel(position: string | null | undefined, fallbackText: string): string {
+function friendlyAnnotationLabel(
+  position: string | null | undefined,
+  fallbackText: string,
+): string {
   const raw = (position ?? "").trim();
   if (raw) {
     // PDF/comic anchors: "page:N"
@@ -61,9 +64,12 @@ function friendlyAnnotationLabel(position: string | null | undefined, fallbackTe
     }
   }
   // Spec fallback: the text's first few words (never a raw locator).
-  const words = stripNote(fallbackText || "").replace(/\s+/g, " ").trim();
+  const words = stripNote(fallbackText || "")
+    .replace(/\s+/g, " ")
+    .trim();
   if (words) {
-    const cut = words.length > 42 ? words.slice(0, words.lastIndexOf(" ", 42)) || words.slice(0, 42) : words;
+    const cut =
+      words.length > 42 ? words.slice(0, words.lastIndexOf(" ", 42)) || words.slice(0, 42) : words;
     return cut;
   }
   return "Location";
@@ -214,10 +220,7 @@ function buildAnnotationRows(
 }
 
 function escapeHtmlForRich(text: string): string {
-  return text
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
 /** The export item text — identical in single and multi modes. */