feat(posts): faithful (semantic) HTML rendering of post bodies

Phase 1 of milestone #64. The body is captured (Phase 0) but was shown as
plain text. Now:
- html_sanitize.py: widen the allowlist to a faithful-but-safe set — headings,
  inline images, lists, blockquote, hr, code/pre, figure, links (div/span stay
  stripped; their text is preserved). Benefits the existing ProvenancePanel too.
- post_feed_service.get_post: add sanitized `description_html` to the DETAIL
  response (the feed list stays lightweight plain text by design).
- PostCard.vue: render description_html via v-html once expanded (fetched with
  detail); collapsed + no-detail fallback stay plain text. Styled close to the
  source (headings, images max-width, accent links, lists, quotes, code).

Tests: sanitizer (headings/img/lists survive, img javascript: src dropped);
get_post returns sanitized description_html.

Refs FC #830.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/services/post_feed_service.py

@@ -22,6 +22,7 @@ from ..models import (
     PostAttachment,
     Source,
 )
+from ..utils.html_sanitize import sanitize_post_html
 from ..utils.text import html_to_plain, truncate_at_word
 from .gallery_service import thumbnail_url
 from .pagination import decode_cursor, encode_cursor
@@ -191,6 +192,10 @@ class PostFeedService:
         atts_map = await self._attachments_for([post.id])
         item = self._to_dict(post, artist, source, thumbs_map, atts_map)
         item["description_full"] = html_to_plain(post.description)
+        # Sanitized HTML body for faithful (semantic) rendering in the post view;
+        # detail-only (the feed list stays lightweight plain text). None when the
+        # post has no body.
+        item["description_html"] = sanitize_post_html(post.description)
         return item
 
     # --- composition helpers ---------------------------------------------