feat(posts): faithful (semantic) HTML rendering of post bodies

Phase 1 of milestone #64. The body is captured (Phase 0) but was shown as
plain text. Now:
- html_sanitize.py: widen the allowlist to a faithful-but-safe set — headings,
  inline images, lists, blockquote, hr, code/pre, figure, links (div/span stay
  stripped; their text is preserved). Benefits the existing ProvenancePanel too.
- post_feed_service.get_post: add sanitized `description_html` to the DETAIL
  response (the feed list stays lightweight plain text by design).
- PostCard.vue: render description_html via v-html once expanded (fetched with
  detail); collapsed + no-detail fallback stay plain text. Styled close to the
  source (headings, images max-width, accent links, lists, quotes, code).

Tests: sanitizer (headings/img/lists survive, img javascript: src dropped);
get_post returns sanitized description_html.

Refs FC #830.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/components/posts/PostCard.vue

@@ -63,8 +63,16 @@
           Post {{ post.external_post_id }}
         </h3>
 
+        <!-- Faithful (semantic) body render once expanded: backend-sanitized
+             HTML (headings, lists, links, inline images). Collapsed and the
+             no-detail fallback stay plain text. -->
+        <div
+          v-if="hasDescription && descExpanded && descHtml"
+          class="fc-post-card__desc fc-post-card__desc--html"
+          v-html="descHtml"
+        />
         <p
-          v-if="hasDescription" ref="descEl"
+          v-else-if="hasDescription" ref="descEl"
           class="fc-post-card__desc"
           :class="{ 'fc-post-card__desc--clamped': !descExpanded }"
         >{{ descText }}</p>
@@ -190,6 +198,9 @@ const descEl = ref(null)
 
 const hasDescription = computed(() => !!props.post.description_plain)
 const fullDescription = computed(() => detail.value?.description_full || null)
+// Backend-sanitized HTML body (detail-only). Drives the faithful render once
+// expanded; falls back to plain text when detail isn't loaded.
+const descHtml = computed(() => detail.value?.description_html || null)
 const descText = computed(() =>
   descExpanded.value
     ? (fullDescription.value || props.post.description_plain)
@@ -219,7 +230,9 @@ onBeforeUnmount(() => { if (ro) { ro.disconnect(); ro = null } })
 
 async function toggleDesc () {
   if (!descExpanded.value) {
-    if (props.post.description_truncated && !fullDescription.value && !detail.value) {
+    // Fetch detail on first expand to get the sanitized HTML body (and the full
+    // plain text) — render the formatted body, not just the truncated preview.
+    if (!detail.value) {
       try {
         detail.value = await postsStore.getPostFull(props.post.id)
       } catch { /* render the truncated text rather than nothing */ }
@@ -369,6 +382,58 @@ function formatBytes (n) {
 @container (min-width: 800px) {
   .fc-post-card__desc--clamped { -webkit-line-clamp: 5; }
 }
+/* Faithful HTML body (expanded). Drop the plain-text pre-wrap and style the
+   semantic tags the backend sanitizer allows. :deep() pierces scoped CSS to
+   reach the v-html subtree. */
+.fc-post-card__desc--html { white-space: normal; }
+.fc-post-card__desc--html :deep(p) { margin: 0 0 0.6em; }
+.fc-post-card__desc--html :deep(p:last-child) { margin-bottom: 0; }
+.fc-post-card__desc--html :deep(h1),
+.fc-post-card__desc--html :deep(h2),
+.fc-post-card__desc--html :deep(h3),
+.fc-post-card__desc--html :deep(h4),
+.fc-post-card__desc--html :deep(h5),
+.fc-post-card__desc--html :deep(h6) {
+  margin: 0.8em 0 0.4em;
+  line-height: 1.25;
+  font-weight: 700;
+}
+.fc-post-card__desc--html :deep(h1) { font-size: 1.3rem; }
+.fc-post-card__desc--html :deep(h2) { font-size: 1.2rem; }
+.fc-post-card__desc--html :deep(h3) { font-size: 1.1rem; }
+.fc-post-card__desc--html :deep(h4),
+.fc-post-card__desc--html :deep(h5),
+.fc-post-card__desc--html :deep(h6) { font-size: 1rem; }
+.fc-post-card__desc--html :deep(a) {
+  color: rgb(var(--v-theme-accent));
+  text-decoration: underline;
+  word-break: break-word;
+}
+.fc-post-card__desc--html :deep(img) {
+  max-width: 100%;
+  height: auto;
+  border-radius: 6px;
+  margin: 0.4em 0;
+}
+.fc-post-card__desc--html :deep(ul),
+.fc-post-card__desc--html :deep(ol) { margin: 0 0 0.6em; padding-left: 1.4em; }
+.fc-post-card__desc--html :deep(li) { margin: 0.15em 0; }
+.fc-post-card__desc--html :deep(blockquote) {
+  margin: 0.6em 0;
+  padding-left: 0.8em;
+  border-left: 3px solid rgb(var(--v-theme-on-surface-variant));
+  color: rgb(var(--v-theme-on-surface-variant));
+}
+.fc-post-card__desc--html :deep(pre) {
+  background: rgba(var(--v-theme-on-surface), 0.06);
+  padding: 0.6em; border-radius: 6px; overflow-x: auto;
+}
+.fc-post-card__desc--html :deep(code) { font-family: monospace; font-size: 0.85em; }
+.fc-post-card__desc--html :deep(hr) {
+  border: 0; border-top: 1px solid rgb(var(--v-theme-on-surface-variant));
+  margin: 0.8em 0; opacity: 0.4;
+}
+.fc-post-card__desc--html :deep(figure) { margin: 0.4em 0; }
 .fc-post-card__desc--missing {
   font-style: italic;
   color: rgb(var(--v-theme-on-surface-variant));