test(viewer): read the rendered handler tag from the regex capture group

CodeQL flags the `replace('<', '')` as incomplete sanitization. The match
always starts with a single '<', but using the existing capture group is both
clearer and avoids the false positive.

Assisted-by: ClaudeCode:claude-opus-4-8
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>

Author: skjnldsv

apps/viewer/test/component/mountViewer.ts

@@ -128,8 +128,7 @@ export function mountViewer(handlers: IHandler[] = []): MountViewerResult {
 
 	const renderedTags = () => {
 		const html = wrapper.html()
-		const matches = html.match(/<(oca-viewer-[a-z0-9-]+)/g) ?? []
-		return matches.map((m) => m.replace('<', ''))
+		return [...html.matchAll(/<(oca-viewer-[a-z0-9-]+)/g)].map(([, tag]) => tag)
 	}
 
 	return {