Refactor call sign rendering for clarity, safety, and maintainability

[Copilot]

The library’s core rendering flow needed a cleanup pass to make it easier to reason about, safer to configure, and more resilient as it evolves. This PR refactors the main call-sign pipeline around clearer parsing and initialization helpers while preserving the existing behavior.

• Summary

  • Reorganized the main script into focused helpers for parsing call signs, reading configuration, sanitizing stylesheet paths, and filtering text nodes during auto-detection.
  • Tightened runtime safety around configuration handling so unsupported or unsafe stylesheet paths fall back to the default stylesheet instead of being injected directly.
  • Simplified the custom-element initialization path so registration and auto-detection run through a single, explicit entry point.

• What changed

  • Extracted parsing and config logic from the constructor to reduce branching and make the rendering flow easier to follow.
  • Hardened data-css-path handling to reject unsafe protocols and cross-origin stylesheet URLs, reducing the risk of unexpected resource injection.
  • Updated the public documentation and demo/docs copy to reflect the current shadow-DOM rendering model, stylesheet injection behavior, and supported configuration options.

• Why this matters

  • The refactor improves readability and maintainability without changing the user-facing behavior of the library.
  • The stricter config handling makes the script safer to embed in a wider range of pages and deployment setups.

[phieri]

@copilot add performance tests to make sure the changes to detection doesn't makes it heavier to run.

[Copilot]

@copilot add performance tests to make sure the changes to detection doesn't makes it heavier to run.

Added a regression-style performance test around searchCallsigns() in tests/searchPerformance.test.js that exercises auto-detection on a larger DOM and asserts it stays within a tight runtime budget. Implemented in commit 2346b94.