id(web): parseWorldSeed still silently reinterprets non-decimal forms — '0x10' installs seed 16, '1e3' seed 1000 (#707 residual) #832

Problem

parseWorldSeed (pkgs/id/web/src/world-seed.ts:9-14) — the parser for the world install/compile seed field, used by both flows in pkgs/id/web/src/world.ts:343 and world.ts:465 — validates with Number() coercion:

const seed = Number(trimmed);
return Number.isSafeInteger(seed) && seed >= 0 ? seed : null;

Number() accepts every JavaScript numeric literal form, so text the admin typed is silently reinterpreted as a different seed than the digits shown:

Verified this run with a node probe of the exact function body on main d95000a1.

Why it matters

• This is the residual half of id(web): clearing the world seed field silently installs with seed 0 — empty input passes the Number() guard in both install and compile flows #707: that fix stopped an empty field silently becoming seed 0 because the seed must be "anything the admin did not actually choose" — the module docstring says exactly that. A hex/scientific string is the same class of silent reinterpretation: the field shows one thing, the world installs with another.
• The seed is load-bearing: the install form states "The current world restarts at its module seed" (pkgs/id/src/web/templates.rs:804), so a mis-parsed seed silently produces different world state with no error anywhere.
• The sibling numeric parser in the same UI is deliberately strict about surface forms: goto-line.ts documents why it avoids bare parseInt semantics. parseWorldSeed should hold the same line — a seed field is a decimal integer field (the input is type="number", templates.rs:796).

Acceptance criteria

• parseWorldSeed accepts only an optional-whitespace-wrapped run of ASCII decimal digits (leading zeros OK) that fits a non-negative safe integer; "0x10", "0b101", "0o17", "1e3", "+5" all return null.
• Existing behavior is unchanged for ""/whitespace (null), "0" (0), " 42 " (42), Number.MAX_SAFE_INTEGER, negatives, fractions, and unsafe integers.
• world-seed.test.ts gains cases covering the rejected literal forms above.
• The web vitest suite passes.