"""Tests for `api.session_export_html` palette injection.
These guard the contract that:
1. A palette captured from the live WebUI (getComputedStyle) flows through the
export and overrides the inlined fallback so the file matches the user's
active theme + skin.
2. The palette is sanitised so a hostile client cannot break out of the
`