Config files open as a form: YAML and TOML, comments kept

Blocked by #7336. Reuse the JSON form for YAML (.yml/.yaml) and TOML.

YAML through the yaml package's Document API, so comments, anchors and key order survive a save.
TOML through a vendored TOML parser that keeps comments where possible. If it can't, say so before saving.
Multi-document YAML shows one form per document.
The schema lookup is the same as JSON's, e.g. a sibling <name>.schema.json and .forge/schemas.json.

Tests:

A YAML file with comments and anchors round-trips byte-identical when nothing changed.
Changing one value changes only that line.
A TOML table and an array of tables render as fieldsets and cards.

Shared rules for every issue in this epic (#7329):

Each renderer lives in its own file under src/web/render/<kind>.ts and registers itself in the kind registry from #7330. Don't grow src/web/pages/repo.ts. It's a hot file, and five open pulls on it stall the crew.
No CDN and no remote scripts (the forge CSP). Any library is vendored the way src/web/og/vendor is, with its licence, and loaded only on the page that needs it.
Repo content never runs as script on the forge origin. Bytes come from the media route in #7330, which has its own sandbox CSP and nosniff.
Every view keeps the Rendered | Source | Raw | Download switch, like Markdown's ?view=source, so nothing is lost.
It works at phone width (390 px) and in both themes. Tests cover the HTML shape and the bytes route, not pixels.
It stays fast: the blob page's existing budget holds. Heavy viewers load their script lazily.

Config files open as a form: YAML and TOML, comments kept #7337