imp: web: transaction tooltips use a fixed-width font, so amounts line up (#2716)

[acinader]

Hovering a transaction in the journal or a register shows its journal entry in the browser's own tooltip, drawn in a proportional font and wrapped at the browser's narrow width: amounts and comments don't line up, and a long entry is hard to read. Fixes #2716.

This PR keeps the tooltip's content and behavior and changes only its format, so the entry reads exactly as it does in the journal. hledger-web now draws the tooltip itself:

• in a fixed-width font, so amounts and comments line up as they do in the journal;
• as wide as the entry's longest line; a line too long for the window wraps at the window edge, indented under its own line;
• within the window, below the pointer or above it when there is no room below; an entry taller than the window is cut off, with a mark at the cut;
• appearing after a short pause, and going away when the pointer leaves, and on a click, a key press, or a scroll, like the browser's own. Over an account link, the link's title (the full account name) shows instead. It follows the mouse only, since a touch has no hover.

The rows carry the entry in a data-entry attribute instead of a title, so the browser doesn't show its own tooltip as well.

Before (Safari's own tooltip, from #2716) and after (this PR), for four of the eight cases in the issue:

CASE01: basic alignment

CASE02: long inline metadata

CASE04: long accounts and mixed amount widths

CASE08: thirty postings

The tooltip's colors are written out (dark gray on white), like the rest of hledger.css on main. #2752 (dark mode) moves the page's colors into a palette; whichever of the two lands second, I'll rebase it so the tooltip takes its colors from the palette.

Tests: two browser tests in webui.spec.js: a journal entry shows on hover and goes away when the pointer leaves or clicks, staying away after a click while the pointer is still on the row; and a register row shows its entry too, while an account link keeps its own title. One in security.spec.js: an entry carrying the fixture's html payload shows it as text in the tooltip. Each failed under a mutation of the new code (the lines set as markup, the click handler removed, an account link's title overridden, the register rows' data-entry removed). All 36 browser tests and the yesod suite pass.

How to test

stack build hledger-web
curl -sO https://raw.githubusercontent.com/acinader/hledger/86f0f6501b708a3bcb62a46ce32d48f416f6fa91/hledger-web/test/tooltip-repro/tooltip-repro.journal
stack exec -- hledger-web -f tooltip-repro.journal --serve --port 5080

Open http://127.0.0.1:5080/journal and hover a transaction's date or description: after a moment its journal entry appears in a fixed-width font, with the amounts in a column. Move to the next transaction and its entry replaces the first at once. Click, and it goes away until the pointer leaves the row.

AI usage: Claude Opus 5.5: ~205k output tokens