Set `draggable="false"` on `<img>` elements in `createCard` and `createDeck`

[arasaka-net]

Card and deck images do not set draggable="false", allowing the browser's native image drag to interfere with the custom grab-and-move interaction. Setting the attribute explicitly suppresses the ghost-image drag across all browsers.

Context
The custom drag system in grab.js calls e.preventDefault() on mousedown, which suppresses native drag in most browsers. However, Firefox and Safari can still initiate a native image drag before the mousedown handler fires on the parent element, producing a translucent ghost image that fights with the custom drag positioning. The HTML spec defaults <img> elements to draggable="true". Setting draggable="false" on each <img> created in createCard (front, back, and tooltip images) and in the createDeck card-back image eliminates this browser-dependent interference. The card-back <img> in createDeck is currently created via innerHTML — the attribute can be added to the template string, or the construction can be switched to DOM APIs (as tracked by issue #328).

Affected Files

• src/scripts/card.js:35 — Add cardFrontImg.setAttribute("draggable", "false") after the img is created
• src/scripts/card.js:42 — Add cardBackImg.setAttribute("draggable", "false") after the img is created
• src/scripts/card.js:50 — Add tooltipImg.setAttribute("draggable", "false") after the img is created
• src/scripts/deck.js:49 — Add draggable="false" to the <img> in the innerHTML template string
• src/scripts/card.test.js — Add assertion that all <img> elements inside a created card have draggable set to "false"

Requirements

• Every <img> element created by createCard (card-front, card-back, tooltip) has draggable="false" set
• The <img> element inside the deck card-back has draggable="false" set
• A unit test in card.test.js asserts that createCard produces img elements with draggable attribute set to "false"
• Existing tests continue to pass without modification

Verification

• npm test -- --reporter=verbose 2>&1 | grep -E 'card.test|deck.test|PASS|FAIL'
• grep -n 'draggable' src/scripts/card.js src/scripts/deck.js

Not In Scope

• Do not refactor createDeck innerHTML to DOM APIs — that is tracked by issue Replace innerHTML with safe DOM construction in createDeck #328
• Do not add draggable to token elements — tokens do not contain <img> children with the same native-drag issue
• Do not modify grab.js drag handling logic

Evidence

• src/scripts/card.js:33-51 — Three <img> elements are created with setAttribute for width, height, and src but none set draggable
• src/scripts/deck.js:47-50 — The deck card-back <img> is created via innerHTML with width and height attributes but no draggable
• src/scripts/grab.js:5-7 — grabCard calls e.preventDefault() and e.stopPropagation() on mousedown, which suppresses native drag in Chrome but not reliably in Firefox/Safari for child <img> elements

_{Arasaka Queue Planning Division.}