followup: share-by-url hardening and test coverage

## Context

Followup items from PR #8951 (feat: workflow sharing and ComfyHub publish flow). All non-blocking, tracked here so nothing falls through the cracks.

## Security hardening

- [ ] **`ShareAssetThumbnail.vue` L46-59** — `normalizedPreviewUrl` has no protocol allowlist; `catch` block returns raw `previewUrl`. Add protocol guard (`http:`, `https:`, `blob:`) and return `null` from catch.
- [ ] **`shareSchemas.ts` L17-22** — `sanitizeWorkflowName` strips `/\:` but not null bytes (`\0`) or control characters (U+0001-U+001F). Add `.replaceAll(/[\x00-\x1f]/g, "")`.

## Accessibility

- [ ] **`ShareWorkflowDialogContent.vue` L11-29, L40-44, L129-134** — Tab buttons have `role="tab"` + `aria-selected` but missing `aria-controls`. Tabpanels lack `id` attrs. Incomplete WAI-ARIA tabs pattern.

## Vue patterns

- [ ] **`ComfyHubThumbnailStep.vue` L239-252, L335-344** — `thumbnailOptions` and `comparisonSlots` call `t()` at setup time (not reactive to locale change). Wrap in `computed()`.
- [ ] **`ComfyHubThumbnailStep.vue` L256, L264** — `isVideoFile` should be a `computed` derived from `thumbnailFile` instead of a manually-synced ref.
- [ ] **`ShareWorkflowDialogContent.vue` L129-131** — `v-if` + `v-show` on publish panel is redundant. Use one or the other.

## Robustness

- [ ] **`useComfyHubProfileGate.ts` L57-59** — `catch` block does not set `hasProfile.value = false`, leaving it `null` (indeterminate for direct UI reads).
- [ ] **`ShareWorkflowDialogContent.vue` L194-202** — Stale detection compares local fs mtime with hub server timestamp. Add comment documenting same-clock assumption.
- [ ] **`workflowShareService.ts` L106, L131, L174** — `response.json()` after ok check has no try-catch. A 200 with non-JSON body throws unhelpful SyntaxError.

## Styling

- [ ] **`ComfyHubCreateProfileForm.vue` L44** — `text-white` hardcoded instead of design token.

## Test coverage gaps

- [ ] No test for `loadGraphData` throwing (`useSharedWorkflowUrlLoader`)
- [ ] No test for `publishWorkflow` HTTP error (`workflowShareService`)
- [ ] No test for `getPublishStatus` non-404 error (e.g., 500)
- [ ] `SharedWorkflowLoadError.isRetryable` branching untested
- [ ] `validateFileSize.ts` has zero tests
- [ ] `getShareableAssets(includingPublic: true)` branch untested

┆Issue is synchronized with this [Notion page](https://www.notion.so/Issue-9453-followup-share-by-url-hardening-and-test-coverage-31b6d73d365081d58498f1a8098352f6) by [Unito](https://www.unito.io)