refactor(markdown): replace htmlparser2 with regex-based sanitizer
Replace htmlparser2 (56KB gzipped) with a zero-dependency regex-based
HTML sanitizer for video/audio/source tags.
Security approach: fail-closed
- Only video, audio, source tags allowed
- Strict attribute allowlist (src, controls, type, etc.)
- Block javascript:, vbscript:, and data:text/html URIs
- If ANY disallowed content detected, escape entire input