docs: document the assistant build flag and widen its e2e coverage

[caitlon]

Problem

The assistant panel had no documentation for the build flag that keeps it out of the default bundle, the security notes did not describe how answers are rendered, and the panel's e2e spec covered neither the phone layout, Czech, nor the dark theme. One Escape test waited on a fixed 500 ms sleep.

Change

• frontend/README.md: an Assistant section with the VITE_ASSISTANT_ENABLED build flag (off by default), where the feature lives, the backend switch, and how to run its e2e spec without a backend.
• docs/security.md: assistant answers go through react-markdown with an element allowlist, no raw-HTML plugin, and https-only source links.
• e2e: the panel as a sheet on a 390x844 viewport, the dialog in Czech, and the dialog in dark theme with an axe audit; the fixed sleep in the Escape test is gone.
• A redundant m-0 on the clear-confirmation fieldset is removed (Tailwind preflight already zeroes it).

Verification

• Default npm run build: no assistant string, i18n key or endpoint path in dist/assets/*.js (grep for the composer placeholder in en and cs, /assistant/chat, /assistant/config, trigger.header, composer.placeholder, the storage key prefix). With VITE_ASSISTANT_ENABLED=true the same terms are found in the lazy chunks.
• VITE_ASSISTANT_ENABLED=true npx playwright test e2e/assistant-panel.spec.ts --project=chromium: 13 passed.
• npm run lint, npm run typecheck, npm run test:coverage (thresholds held).

Migrations

None.

Screenshots

None.

[greptile-apps]

Automatic reviews are disabled for this repository.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud