Add fragment navigation support: clicking <a href="#id"> scrolls to the
matching element without reloading the page. Handles fragment-only links,
cross-document URLs that only differ in fragment, and history traversal
for fragment changes.

Changes:
- Url::equals_ignoring_fragment() and Url::set_fragment() for detecting
and manipulating fragment-only URL changes
- Document::find_anchor_by_name() for legacy <a name="..."> fallback
- create_hashchange_event() for the HashChangeEvent JS object
- navigate_fragment() in the browser main loop: updates URL, pushes
history entry, scrolls to target element, fires hashchange
- navigate_to_link() now detects fragment-only links and same-document
fragment changes instead of ignoring them
- navigate_history() avoids page reload for fragment-only traversals
- find_element_y_in_layout() walks the layout tree to find an element's
absolute Y position for scroll targeting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add navigation_error_page() that generates specific, descriptive error
pages based on the LoadError type. Each error type gets a tailored title,
description, and technical details code:

- DNS resolution failures: hostname + DNS_RESOLUTION_FAILED
- Connection refused/timeout: host + CONNECTION_REFUSED/TIMED_OUT
- TLS errors: specific reason (expired cert, wrong host, etc.)
- HTTP 4xx/5xx: status code + reason phrase with friendly titles
- Redirect loops: ERR_TOO_MANY_REDIRECTS / ERR_REDIRECT_LOOP
- Invalid URLs, unsupported schemes, encoding errors, CSP/CORS blocks

Error pages include a styled reload link pointing back to the failed URL,
and set base_url to the failed URL so the address bar shows the intended
destination. All user-provided strings are HTML-escaped to prevent XSS.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Route fetched resources to appropriate renderers based on Content-Type:
- HTML renders normally (no regression)
- Plain text, CSS, JS, JSON, XML display in monospace <pre> blocks
- Images display centered in viewport via data URL embedding
- Unsupported binary types show friendly "Cannot Display" message
- Missing Content-Type triggers content sniffing (magic bytes, HTML
detection, text heuristic)

Adds base64_encode to we-url for image data URL generation.
Refactors loader to use shared classify_and_decode helper, eliminating
duplicated MIME routing logic across fetch/post_form/decode_response.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>