feat(review): icon buttons with labels for expand and collapse

The review page toolbar showed Expand all and Collapse all as text. They are now Bootstrap Icons (arrows-expand, arrows-collapse) inlined as SVG under the page's strict CSP, with title and aria-label carrying the words; the Bootstrap Icons MIT licence ships next to the template as package data. A test checks the labels, the icon classes, no visible text and no external resource.

🎯 Fix: 95 %
💥 Break: 2 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 93
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_review.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import io
 import os
+import re
 import subprocess
 import tempfile
 import unittest
@@ -160,6 +161,27 @@ class TestReview(unittest.TestCase):
         self.assertNotIn("big 11</td>", html)
         self.assertIn("20 more lines not shown", html)
 
+    def test_toolbar_buttons_are_labelled_icons(self) -> None:
+        html = self._render("page.html", None, [])
+
+        for key, label in (("expand", "Expand all"), ("collapse", "Collapse all")):
+            with self.subTest(button=key):
+                button = re.search(
+                    rf'<button type="button" id="{key}-all"([^>]*)>(.*?)</button>',
+                    html,
+                    re.DOTALL,
+                )
+                self.assertIsNotNone(button)
+                attrs, inner = button.groups()
+                self.assertIn(f'title="{label}"', attrs)
+                self.assertIn(f'aria-label="{label}"', attrs)
+                self.assertRegex(
+                    inner, rf'^<svg class="bi bi-arrows-{key}"[^>]* aria-hidden="true"'
+                )
+                self.assertEqual(re.sub(r"<[^>]+>", "", inner).strip(), "")
+        self.assertNotIn("<link", html)
+        self.assertNotIn("<img", html)
+
     def test_errors_exit_two(self) -> None:
         plain = os.path.join(self.root, "plain")
         os.makedirs(plain)