fix: address code review findings for bookmark feature (H1–L5)

Fix broken tests (H1), align interface signatures with implementations (H3),
remove dead code (H4), add missing input guard (M1), replace raw $_SESSION
access with SessionStoreInterface (M2), sync update script schema (M4),
use shared getAppBase utility (L2), document fragment stripping (L3),
and apply app- CSS class prefix convention (L5).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/css/components/app-bookmark-form.css

@@ -108,7 +108,7 @@
     color: var(--app-primary);
   }
 
-  .app-bookmark-group-icon-option.active {
+  .app-bookmark-group-icon-option.app-bookmark-icon-active {
     border-color: var(--app-primary);
     background: var(--app-primary);
     color: #fff;