- Only pre-fill annotation textarea for single-select, clear for multi
- Add .multi-count CSS class for multi-select count display

Add click-drag rubber band selection on empty space. Uses HTML overlay
for drawing the selection rectangle and SVG getBBox + getScreenCTM for
screen-space collision detection. Supports Ctrl+drag for additive mode.
5px threshold prevents accidental activation on clicks.

- Add cancelRubberBand() helper, call from selectSlide to reset state
- Remove unused addToSelection parameter from selectByRubberBand
- Fix overlay variable shadowing in mouseup handler
- Clear selection on below-threshold click (preserves original behavior)

Ctrl+A selects all SVG elements (skips when textarea focused).
Escape clears current selection.

Show element properties in right panel on selection:
- Text: font, font-size, font-weight, fill, anchor, content preview
- Shapes: fill, stroke, dimensions
- Images: filename, dimensions
- Multi-select: type count summary, shared font-size, element list

- Remove annotationText.focus() from updateSelectionPanel — it was
  causing Ctrl+A to be intercepted by the textarea guard, and
  interfering with rubber band drag operations
- Fix rubber band mousedown check: use closest('.svg-selectable')
  instead of direct classList check, so clicking on SVG background
  or container elements correctly starts rubber band
- Add rubberBandUsed flag to prevent SVG click handler from clearing
  selection after a rubber band operation completes

Rubber band:
- Remove closest('.svg-selectable') guard from mousedown — it failed
  when SVG had a background rect covering the canvas (all clicks
  matched the guard, preventing rubber band from starting)
- Start tracking on every mousedown, only activate overlay and set
  rubberBandUsed flag when mousemove exceeds threshold
- This allows element clicks to still work (below threshold) while
  rubber band works for any drag (regardless of target element)

Other fixes:
- Add textarea focus guard to Escape handler — prevents clearing
  selection when user is typing in annotation textarea
- Make rubber band more visible: 2px dashed border, higher opacity

Add XSS protection to sanitizeSvg — strip href/xlink:href attributes
that contain javascript: protocol from <a> elements. Prevents potential
XSS via crafted SVG content.

Security:
- Block data: URIs in sanitizeSvg (defense-in-depth against XSS)
- Validate CSS color values before inserting into style attributes
  to prevent CSS injection via crafted SVG fill/stroke values

Bug fixes:
- Ctrl+click on empty space now respects modifier key (was clearing
  selection unconditionally)

Improvements:
- Use diagonal distance for rubber band threshold (consistent between
  mousemove and mouseup handlers)
- Cache #element-props in DOM refs block (consistent with pattern)
- Add max-height/overflow-y to property panel (prevents layout push)