fix(viewer): preserve dashboard scroll and show API errors

[wbugitlab1]

Summary:

• Preserve dashboard scroll position across manual, debounced polling, and websocket-triggered refresh paths.
• Add bottom-right viewer toasts for API HTTP errors, network failures, and browser-side request timeouts.
• Keep error output safe by writing toast content through DOM text nodes and add VM coverage for escaped hostile text.

Verification:

• corepack pnpm exec vitest run test/viewer-session-id.test.ts
• corepack pnpm exec vitest run test/viewer-session-id.test.ts test/viewer-security.test.ts test/viewer-graph-cooldown.test.ts
• corepack pnpm exec vitest run test/viewer-session-id.test.ts test/viewer-security.test.ts test/viewer-graph-cooldown.test.ts test/viewer-token-savings.test.ts
• corepack pnpm test
• corepack pnpm run build
• corepack pnpm run lint
• semgrep scan --config p/default --error --metrics=off .
• gitleaks protect --staged --redact

Fixes #507