feat(posts): faithful (semantic) HTML rendering of post bodies

Phase 1 of milestone #64. The body is captured (Phase 0) but was shown as
plain text. Now:
- html_sanitize.py: widen the allowlist to a faithful-but-safe set — headings,
  inline images, lists, blockquote, hr, code/pre, figure, links (div/span stay
  stripped; their text is preserved). Benefits the existing ProvenancePanel too.
- post_feed_service.get_post: add sanitized `description_html` to the DETAIL
  response (the feed list stays lightweight plain text by design).
- PostCard.vue: render description_html via v-html once expanded (fetched with
  detail); collapsed + no-detail fallback stay plain text. Styled close to the
  source (headings, images max-width, accent links, lists, quotes, code).

Tests: sanitizer (headings/img/lists survive, img javascript: src dropped);
get_post returns sanitized description_html.

Refs FC #830.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_post_feed_service.py

@@ -419,6 +419,24 @@ async def test_get_post_returns_full_description(db):
     assert len(item["description_full"]) > 280
 
 
+@pytest.mark.asyncio
+async def test_get_post_returns_sanitized_html_body(db):
+    artist = await _seed_artist(db, "alice-html")
+    src = await _seed_source(db, artist.id, "patreon", "https://p/alice-html")
+    p = await _seed_post(
+        db, src.id, external_id="HTMLBODY", post_date=datetime.now(UTC),
+        description='<h2>Heading</h2><p>body</p><script>alert(1)</script>',
+    )
+    await db.commit()
+
+    item = await PostFeedService(db).get_post(p.id)
+    # Detail carries the sanitized HTML body for faithful rendering; <script> is
+    # stripped, semantic tags survive.
+    assert item["description_html"] is not None
+    assert "<h2>" in item["description_html"]
+    assert "<script>" not in item["description_html"]
+
+
 @pytest.mark.asyncio
 async def test_get_post_unknown_returns_none(db):
     item = await PostFeedService(db).get_post(99999)