feat: render safe raw HTML in the editor

[Azganoth]

Summary

• Render complete, attribute-free raw HTML from the accepted allowlist while preserving the authored token as the serialization source of truth.
• Replace the detached HTML input with shared in-document source projection, including multiline editing, history/save finalization, and caret placement at the rendered position that was clicked.
• Keep incomplete, unsupported, and separately tokenized HTML as layout-neutral muted source, and give live block HTML ordinary whitespace and block flow.

Related Issue

Closes #62

Verification

• pnpm exec vitest run src/features/editor/utils/safeHtml.test.ts src/features/editor/tests/sourceProjectionHtml.test.ts src/features/editor/tests/htmlSafety.test.tsx src/features/editor/tests/editorPresentation.test.ts verifies the render predicate, security fallback, exact source-position mapping, projection behavior, and presentation rules.
• pnpm check:frontend verifies formatting, TypeScript, lint, the production build, and the complete frontend test suite with coverage.

Not verified: the desktop E2E suite was not run locally; CI will exercise the updated WebView scenario.

Notes

The source-located parse constructs the validated DOM through element and text-node primitives instead of adopting a browser-parsed template. This differs mechanically from the spike prototype while retaining its security boundary: no HTML string is reparsed into the document and rejected trees are never partially sanitized. Retained source locations provide exact rendered-click mapping back to authored offsets.