Split reviewer media server integration

[andrewsanchez]

Source split from ankitects#4289.

Breakdown sections covered:

• 6. Python-side NextCardData intercept
• 30. Reviewer hook parity
• 32. Media-serving CORS for sandboxed iframe assets
• 33. External links in iframe

Source fidelity:

• This PR copies exact final file contents from PR Feat/Svelte port for reviewer ankitects/anki#4289.
• No implementation changes were made while splitting.
• Commit author is preserved as Luc Mcgrady.

Follow-up notes from the breakdown:

• Hook parity still needs a dedicated audit against the legacy reviewer.
• External links and embedded user iframes remain an open design issue.
• The CORS/media route behavior should be reviewed with MathJax fonts and user media.