Mark control characters in cells with a labelled chip - #28

…oom (#26, #27, #28)

Three contributions from @yukina3230, reviewed and merged as #26, #27 and #28.

XML export adds a fourth format to the Export menu. Element names are far
stricter than JSON keys, so header sanitising is its own step instead of
reusing uniqueKeys: illegal characters become underscores, a name that cannot
start an XML Name gets a leading underscore, and uniquing runs after that,
since "a b" and "a-b" both collapse to "a_b". Cell text goes out verbatim,
because XML has no number type and coercing "2.50" would only lose formatting.
Control characters are dropped, since XML 1.0 cannot carry them at all, not
even as a numeric reference. That is the one place the export is not lossless,
so the README says so on both entries it touches.

Control characters inside a cell used to draw an anonymous box, with no way to
tell which character it was without exporting the file. They now render as a
chip with the ASCII abbreviation and the full name on hover. The renderer
builds its DOM with createElement rather than returning an HTML string, so no
markup from the file ever reaches innerHTML. Display only, the stored value is
untouched, and copy reads the value from state rather than the DOM.

Zoom was the real bug of the three. It scaled the toolbar, footer and profile
panel along with the grid, which re-laid out the toolbar on every step, so the
zoom buttons slid out from under the pointer and a second click landed on the
neighbour. It now sets only the four grid variables. Two sizes JavaScript used
to compute moved into CSS, so the 100% view is unchanged.

The README needed one decision on merge: #27 rewords the Zoom line while #28
adds a line directly below it. Kept both.