refactor(markdown): replace htmlparser2 with regex-based sanitizer

[gary149]

Summary

• Replaces htmlparser2 (56KB gzipped) with a zero-dependency regex-based HTML sanitizer
• Maintains Web Worker compatibility (no DOM required)
• Same security guarantees with fail-closed approach

Changes

• Remove htmlparser2 dependency from package.json
• Replace DOM-based sanitization with regex-based sanitizeMediaHtml() function
• Only allows video, audio, source tags with strict attribute allowlist
• Blocks javascript:, vbscript:, and data:text/html URIs
• If ANY disallowed content is detected, escapes the entire input

Bundle Size Impact

• Before (htmlparser2): +56KB gzipped
• After (regex): +0KB (no new dependencies)

Test plan

• All existing tests pass (14/14)
• TypeScript check passes
• Video/audio tags render correctly
• Event handlers stripped from media tags
• JavaScript/VBScript URLs blocked
• Disallowed tags escaped entirely