Configuration-driven approach refactor.

[dlrice]

Purpose

• Replace hardcoded src/config.ts with a declarative, YAML/JSON-authored config surface so embedders can customize categories, tracks, sources, filters, and tooltips without forking.
• Deliver the SSI/RSMF config-as-data redesign end-to-end: parse → validate → normalize → extends → load → render.

Approach

• New src/schema/: JSON Schema, js-yaml-backed parser, two-pass validator (Ajv + semantic), normalizer (shorthand expansion, inheritance cascade, duplicate-id detection), extends merger (with URL/file fetcher, 2 MiB cap, cycle detection), registry (adapters / kinds / transforms / themes), Vega-Lite-parity transform engine.
• Old src/config.ts deleted → src/default-config.yaml (drives the same 15 UniProt categories).
• <protvista-uniprot> now consumes NormalizedConfig directly via resolveViewerConfig() (precedence: viewerConfig property > config-src attribute > bundled default).
• Per-kind tooltip modules replaced with a declarative fields / markdown / custom resolver backed by Markdoc; helpers frozen; URLs routed through a scheme allowlist; all interpolations HTML-escaped.
• Click-triggered popover built on @floating-ui/dom with role="tooltip", keyboard Escape, scroll-dismiss, focus capture/restore.
• Runtime escape-hatch: setTrackData(categoryId, trackId, data) for from: custom tracks (spec AC #1143).
• Concurrency: AbortController cancels in-flight _loadData() on re-entry and disconnect.
• DOM queries scoped per-instance via CSS.escape to prevent cross-talk when two viewers co-exist.

Testing

• 409 vitest tests across 23 files, all green; tsc --noEmit and eslint src --ext .ts both clean.
• Schema pipeline: validate, normalize, extends (incl. cycle, size-cap, and parse-error-context regression), transforms (incl. Vega-Lite FieldPredicate parity suite), registry, types, schema, load.
• Tooltips: helpers (incl. XSS regression suite for javascript:/data: URLs, quote-break, <img onerror>), resolve, popover, defaults, links.
• Component integration: render-target, set-track-data, set-track-data-integration (mounts <protvista-uniprot> and drives setTrackData end-to-end), load-data-resolver, filter-config.
• Coverage improved net-positive (~4.7k test lines added vs. ~0 for the deleted per-kind tooltip modules).

Visual changes

• Tooltip popover is now rendered via @floating-ui/dom (arrow, flip/shift middleware) instead of the legacy positioning. Content is unchanged by default for every built-in kind. No other UI changes.

Checklist

• My PR is scoped properly, and "does one thing only" — all changes serve the single goal of config-as-data.
• I have reviewed my own code (plus a fresh-eyes independent review pass; findings addressed).
• I have checked that linting checks pass and type safety is respected.
• I have checked that tests pass and coverage has at least improved.
• If needed, the changes have been previewed by all interested parties.