refactor: extract hardcoded config from AppShell template

[Alexi5000]

Summary

Extracts hardcoded configuration values from the AppShell.js HTML template into a dedicated src/core/constants.js module:

• TTS_PROVIDERS: Provider ID/label pairs for the settings dropdown
• TRANSCRIPT_UPLOAD_ACCEPT: Accepted file types for transcript panel uploads
• CANVAS_SANDBOX_PERMISSIONS: iframe sandbox attribute values

The shell template (buildShellHTML()) now interpolates these constants at runtime instead of embedding them directly in the markup.

Motivation

Adding or removing a TTS provider currently requires finding and editing the HTML string in AppShell.js. With this change, provider definitions live in one place — constants.js — making the system easier to extend and less error-prone.

Addresses #234.

Changes

File	Change
src/core/constants.js	New module exporting TTS_PROVIDERS, TRANSCRIPT_UPLOAD_ACCEPT, CANVAS_SANDBOX_PERMISSIONS
src/ui/AppShell.js	Convert static template to buildShellHTML() function; interpolate constants

Test Plan

• UI loads without errors (settings drawer renders provider options)
• TTS provider dropdown shows all 3 providers
• File upload input accepts the same file types as before
• Canvas iframe loads with correct sandbox permissions

[MCERQUA]

Thanks for this @Alexi5000 — nice cleanup, and it pairs well with your accessibility PR.

Heads-up on what I did so nothing's a surprise: your #320 (ARIA labels) merged into dev first, and it touched the same SHELL_HTML block this PR refactors into buildShellHTML(). To avoid your accessibility work getting clobbered, I merged the latest dev into this branch and confirmed both survive — your buildShellHTML()/constants.js refactor and all the aria-*/role labels from #320 are intact, and node --check passes on both files. Your original commit and authorship are unchanged; the only thing I added is the merge/reconcile commit. Retargeted to dev per our contributor flow. Merging now — appreciate the contribution. 🙏