fix: mirror server custom CSS validation on the client

The form only enforced the length cap, so CSS with an external url() or @import
passed client validation and was rejected by the server. Add the same tokenizer
based check with the same error message so it is caught inline before submit.

client/src/Utils/customCss.ts

@@ -0,0 +1,16 @@
+import { isTokenString, isTokenURL, tokenize } from "@csstools/css-tokenizer";
+
+// Mirrors the server check (server/src/utils/customCss.ts) so the form rejects
+// the same CSS the API would.
+const EXTERNAL_TARGET = /^\s*(?:https?:|\/\/)/i;
+
+export const cssReferencesExternalResource = (css?: string | null): boolean => {
+	if (typeof css !== "string" || css === "") {
+		return false;
+	}
+
+	return tokenize({ css }).some(
+		(token) =>
+			(isTokenURL(token) || isTokenString(token)) && EXTERNAL_TARGET.test(token[4].value)
+	);
+};