feat: expand IBAN workbench

[Raafet57]

Summary

• Upgrades /iban into an IBAN Workbench with Validate, Build, Catalogue, and Provenance panels.
• Adds registry-derived BBAN field templates plus local ISO 13616 MOD-97 check-digit assembly, with exact-length/wrong-charset rejection and no auto-padding/inference.
• Strengthens IBAN privacy guardrails so IBAN module code remains static/bundled with no fetch/XHR/storage/cookie/telemetry APIs.

Motivation

The roadmap’s next product refinement was to turn the narrow IBAN validator into a fuller offline workbench while preserving the suite’s browser-only/privacy-first and no-live-reference-data boundaries.

Changes

• Adds src/lib/iban/structure.ts and src/lib/iban/build.ts for BBAN template derivation and IBAN assembly.
• Adds all-country example round-trip coverage plus structure/build regression tests.
• Refactors /iban into tabbed Validate / Build / Catalogue / Provenance panels.
• Updates home card, app route test, README, ROADMAP, and Playwright IBAN coverage.
• Extends scripts/privacy-audit.sh with IBAN-specific banned API checks.

Test Plan

• git diff --check
• pnpm verify
• pnpm test:e2e — 20/20 passed
• npx -y @google/design.md lint DESIGN.md — 0 errors, existing unused-token warnings only
• Added-line security scan — no hardcoded secrets, shell/eval/deserialization, browser persistence/telemetry/network usage
• Direct IBAN source API scan — no fetch, XHR, storage, cookie, or telemetry API usage
• Codex implementation review — APPROVED

Notes for Reviewers

• IBAN Build uses bundled registry masks/examples only; it does not perform account existence checks, VOP, live BIC lookup, SEPA reachability, or bank-directory enrichment.
• computeCheckDigits necessarily left-pads the computed two-digit check value, but BBAN/user fields are never auto-padded.
• No deployment, release, tag, or public announcement is included in this PR.