Regex tester & ReDoS checker

Runs in an isolated worker with a 2-second limit. Timing and static warnings are heuristics, not proof that a pattern is safe.

Two independent checks: a structural scan for the shapes that permit exponential backtracking, and an empirical timing run against adversarial input. They catch different things, so both are reported. A pattern that passes here is not proven safe — safety against a specific attacker's input cannot be proven by sampling — but a pattern that fails here is definitely exploitable. Runs in your browser.