feat: replace syntect with arborium for syntax highlighting

[abusch]

Replaces syntect + two-face with arborium's tree-sitter grammars, using its structured span API (highlight_spans + spans_to_flat_tokens) rather than its HTML or ANSI renderers.

Why

• Drops both RUSTSEC ignores from deny.toml. yaml-rust (RUSTSEC-2024-0320) and bincode (RUSTSEC-2025-0141) reached the tree only through syntect. cargo deny check now reports advisories ok, bans ok, licenses ok, sources ok with no ignores and no warnings.
• ~4x faster highlighting: 107µs/block vs 410µs measured on the same input. This matters because page.rs re-highlights on every render and resize.
• Faster startup: grammars compile lazily on first use, replacing syntect's eager ~4.3ms syntax-set load.

Trade-off

Only the Rust grammar is compiled in. Rustdoc code blocks are overwhelmingly Rust, and each additional grammar costs binary size. Other fences (toml, json, sh, c, cpp, py) now render as plain text instead of highlighted.

code_language() is unchanged, so re-enabling any of them is a feature flag plus one line in the language mapping.

Release binary grows 1.4MB → 7.6MB; locked packages drop 208 → 200.

Implementation notes

Highlighter wraps arborium::Highlighter in a RefCell — arborium needs &mut to parse, but rendering only ever holds &Highlighter. This keeps highlight(&self, ..) intact, so page.rs/app.rs/ui.rs are untouched.

Raw arborium spans are unordered and overlapping, so the conversion has to: flatten them into a disjoint token stream (spans_to_flat_tokens, innermost match wins), emit the untagged gaps between tokens, and split tokens that straddle newlines.

The theme moves from syntect's base16-eighties.dark to arborium's monokai.

Testing

62 tests pass, including the existing method_docs_are_rendered_and_highlighted. Four new tests cover the risk areas of the span conversion:

• source text is preserved exactly through highlighting (guards the gap/newline handling)
• Rust code actually receives colour
• non-Rust falls back to plain text
• empty code blocks don't panic

clippy and cargo fmt --check are clean.

🤖 Generated with Claude Code