Page Overlay Alert

Public OBS follow/sub ALERT overlay page. Same model as the chat overlay: no auth (the path token gates the DATA at /api/overlay/{token}/events, not this page), trusted author-controlled template served same-origin on the main host so there is no CSP/sandbox question, and the same validated theme injection (overlay_theme.validate_theme on every request). The template reads the token client side, polls the events feed, and plays an alert per new event; the untrusted actor name is rendered via textContent. ?demo=1 previews the look without a real event.