Files render in the browser: CSV/TSV as a real table — sticky header, sort, filter, row count #7334

Blocked by #7330.

• Parse properly: RFC 4180, with quoted fields, embedded newlines, escaped quotes and a BOM. Detect the delimiter (, ; tab |).
• Render server-side as a table: the first 1,000 rows plus a sticky header row and a sticky first column on phones. Numbers are right-aligned when a column is numeric.
• Without JavaScript, "Show all N rows" uses the existing all path up to a cap.
• Light client JS adds sort on a header click and a filter box, with no library.
• The header line shows rows × columns and the delimiter.
• A malformed file falls back to the source view with a one-line reason.

Tests:

• The parser cases: quotes, newline-in-field, BOM, ; and tab.
• A 50k-row file renders the first 1,000 within the page budget.
• A numeric column is detected.

Shared rules for every issue in this epic (#7329):

• Each renderer lives in its own file under src/web/render/<kind>.ts and registers itself in the kind registry from #7330. Don't grow src/web/pages/repo.ts. It's a hot file, and five open pulls on it stall the crew.
• No CDN and no remote scripts (the forge CSP). Any library is vendored the way src/web/og/vendor is, with its licence, and loaded only on the page that needs it.
• Repo content never runs as script on the forge origin. Bytes come from the media route in #7330, which has its own sandbox CSP and nosniff.
• Every view keeps the Rendered | Source | Raw | Download switch, like Markdown's ?view=source, so nothing is lost.
• It works at phone width (390 px) and in both themes. Tests cover the HTML shape and the bytes route, not pixels.
• It stays fast: the blob page's existing budget holds. Heavy viewers load their script lazily.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.