feat(posts): faithful (semantic) HTML rendering of post bodies

Phase 1 of milestone #64. The body is captured (Phase 0) but was shown as
plain text. Now:
- html_sanitize.py: widen the allowlist to a faithful-but-safe set — headings,
  inline images, lists, blockquote, hr, code/pre, figure, links (div/span stay
  stripped; their text is preserved). Benefits the existing ProvenancePanel too.
- post_feed_service.get_post: add sanitized `description_html` to the DETAIL
  response (the feed list stays lightweight plain text by design).
- PostCard.vue: render description_html via v-html once expanded (fetched with
  detail); collapsed + no-detail fallback stay plain text. Styled close to the
  source (headings, images max-width, accent links, lists, quotes, code).

Tests: sanitizer (headings/img/lists survive, img javascript: src dropped);
get_post returns sanitized description_html.

Refs FC #830.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_html_sanitize.py

@@ -36,3 +36,19 @@ def test_javascript_href_dropped():
     out = sanitize_post_html('<a href="javascript:alert(1)">x</a>')
     assert "javascript:" not in out
     assert "x" in out  # text preserved, dangerous href removed
+
+
+def test_headings_lists_and_images_survive():
+    out = sanitize_post_html(
+        '<h2>Title</h2><p>x</p>'
+        '<img src="https://cdn.test/a.jpg" alt="art" width="200">'
+        '<ul><li>one</li></ul><blockquote>q</blockquote>'
+    )
+    assert "<h2>" in out
+    assert '<img' in out and 'src="https://cdn.test/a.jpg"' in out and 'alt="art"' in out
+    assert "<li>" in out and "<blockquote>" in out
+
+
+def test_image_javascript_src_dropped():
+    out = sanitize_post_html('<img src="javascript:alert(1)" alt="x">')
+    assert "javascript:" not in out