feat(ie-js): implement JavaScript DOM bindings #81

DOM bindings via Rc<RefCell<Document>> shared between Rust and JS:

document global:
- getElementById(id) → element or null
- createElement(tag) → element
- createTextNode(text) → element
- getElementsByTagName(tag) → array of elements

Element methods (each carries __nodeId):
- appendChild(child), removeChild(child)
- getAttribute(name), setAttribute(name, value)
- getTextContent(), setTextContent(text)
- getTagName()

JsRuntime::new_with_document(doc) registers document global.
Uses unsafe NativeFunction::from_closure to capture Rc<RefCell<Document>>
(safe: no GC-traced types in closure captures).

13 new tests covering creation, lookup, attributes, tree mutation,
text content. 20 total ie-js tests.

Author: thomasnemer