Test coverage: render.js, badge.js, reader.js have no unit tests

[itsbdell]

Problem

`site/validator.js` has 16 tests in `site/validator.test.js`. The
other three browser modules don't:

• `site/render.js` — DOM rendering helpers, the `safeWebUrl` URL
  gate, schema-error rendering. `safeWebUrl` is security-relevant;
  it filters `javascript:`, `data:`, and `vbscript:` URLs out of
  any href / src in user-supplied feed data. Untested.
• `site/badge.js` — feed normalization, snippet generation, escape
  helpers, copy fallback.
• `site/reader.js` — orchestration: fetch, fallback to
  `/.well-known/apps.json`, error envelope shape.

Acceptance criteria

• `safeWebUrl` has a test asserting it rejects each unsafe scheme
  individually (`javascript:`, `data:`, `vbscript:`,
  uppercase variants, leading whitespace) and accepts `http` and
  `https`.
• `renderSchemaErrors` and `renderError` have at least smoke tests
  with jsdom or happy-dom.
• `badge.js` snippet generators are pure functions extractable from
  the DOM module and tested directly.

Notes

Pulling pure helpers out of the DOM modules into testable shapes is
half the work. The other half is wiring jsdom into the test runner.