feat: add toast notification component

[GautamKumarOffical]

Summary

Adds a toast notification component with three variants to the brand design system.

Closes #7

What this PR does

Creates a toast notification component that:

• Uses CSS variables from tokens.css for consistent styling
• Supports three variants: success (green), warning (amber), error (red)
• Auto-hides after configurable duration
• Includes close button for manual dismissal
• Uses smooth fade-in/fade-out animations

Files added

• components/toast.css — Toast styles using design tokens
• components/toast.js — Toast component logic

Usage

import { toastSuccess, toastWarning, toastError } from './components/toast.js';

toastSuccess('Operation completed!');
toastWarning('Please check your input');
toastError('Something went wrong');

Acceptance Criteria

• Toast component using CSS variables from tokens.css
• Three variants: success (green), warning (amber), error (red)
• Auto-hide after configurable duration
• Close button for manual dismissal
• Smooth animations

[abhicris]

Welcome to kcolbchain, @GautamKumarOffical — glad you're here. 🌱

Here's what happens from this PR:

1. Our automated review looks for obvious issues (tests, secrets, size) within a couple of hours.
2. If it's clean and CI passes, we merge without back-and-forth.
3. If we need changes, we'll leave a specific comment — not a generic nit. Push another commit and we re-review.

While you wait:

• Run the repo's tests locally (see the repo README.md).
• Keep the PR scoped to one concern — bigger PRs land slower.
• Don't commit tokens or .env contents.

What happens after your first merge

• You're listed on https://kcolbchain.com/contributors/ (opt-out anytime via data/contributors-optout.txt).
• At 2+ merged PRs you're a Regular; at 5+ you're a Fellow — Fellows are the pool we invite first for paid research, partner-org gigs, and grant-funded work. Details: https://kcolbchain.com/docs/org-contribution-policy.html
• Looking for what to pick up next? https://kcolbchain.com/invitations/ lists open help-wanted / good-first-issue across every kcolbchain repo.

Thanks for writing the code. We're building this to last.

[abhicris]

🤖 Audit verdict: needs_human

Toast component uses innerHTML to render user-supplied message parameter, creating a potential XSS vector if not sanitized at call sites.

Risks flagged:

• innerHTML with unsanitized user input (XSS risk)

Audited by the kcolbchain PR pipeline. See pipeline docs.

[GautamKumarOffical]

Fixed the XSS issue flagged by the audit. Replaced innerHTML with textContent for the message parameter and used proper DOM API (createElement, addEventListener) instead of string interpolation. No more unsanitized user input.