Give the editor a Markdown toolbar and preview, restyle the dashboard

The post/page/announcement editor was a bare textarea, so bloggers had to
know the Markdown syntax by heart. It now has a toolbar (bold, italic,
strike, heading cycle, quote, code, lists, rule, link box, insert file),
Ctrl+B/I/K, list continuation on Enter and a Write/Preview toggle that
renders the text through the same goldmark + bluemonday pipeline a save
uses (POST /b/{sub}/preview; nothing is stored). Every edit goes through
execCommand("insertText") so browser undo keeps working. The toolbar
stays hidden without JavaScript, leaving the old form untouched.

The dashboard moves from the "paper & ink" look to a lean one: neutral
surfaces, 1px borders, one blue accent, system sans, with custom
properties and flexbox/grid now allowed there (blog.css is unchanged).
Class names were kept so the templates barely change; a global [hidden]
rule keeps flex containers from overriding the hidden attribute.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 16 insertions, 8 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 4a04077..c716515 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -29,8 +29,9 @@ table and deployment notes.
   blog is backed up and restored with plain `pg_dump`/`psql`; the control
   database (`DATABASE_URL`) holds only `users` and the `blogs` registry.
 - Posts are Markdown (goldmark → bluemonday). No WYSIWYG. The editor's
-  "Insert file" is the one scripted convenience (`partials/editor.html`);
-  it must keep its no-JS fallback (file appended on save).
+  toolbar, preview and "Insert file" are scripted conveniences over a plain
+  textarea (`partials/editor.html`); the no-JS fallback (bare textarea, file
+  appended on save) must keep working.
 - Changes are live immediately — there is no draft/preview system. The UX
   is "save, then refresh your blog tab"; keep the "View blog ↗" links.
 - Theme customisation is a structured form only; **no custom CSS input**.
@@ -62,8 +63,9 @@ internal/web/         server.go (host router, middleware, render helpers)
                       files = the upload library), filetype.go (what an upload is, how it may be served)
                       theme.go (colours/fonts/layout switches), layout.go (module kinds, archive grouping)
                       templates/ (embedded; layouts/, partials/, auth/, dashboard/, admin/, blog/)
-                      static/ (dashboard.css "paper & ink" look — plain CSS, no variables/flex;
-                               blog.css — floats except the three-column `.cols`, which is flexbox)
+                      static/ (dashboard.css — lean look; custom properties, flexbox and grid
+                               are fine there. blog.css — floats except the three-column `.cols`,
+                               which is flexbox; it must keep working on old browsers)
 ```
 
 ## Key mechanics
@@ -211,10 +213,16 @@ internal/web/         server.go (host router, middleware, render helpers)
   10), set at `POST /admin/blogs/{id}/upload-limit` from `admin/index.html`;
   `Blog.UploadLimit(cfg)` resolves it.
 - **Editor** (`partials/editor.html`, args via `dict`: name, value, rows,
-  tall, upload, csrf): textarea + "Insert file" + cheat-sheet; paste and
-  drop take any file. Forms using it must be `multipart/form-data` and
-  their save handler must call `s.readUpload(r, "inline_file", false)` +
-  `appendFileMD` (the no-JS path).
+  tall, upload, preview, csrf): a textarea with a Markdown toolbar (bold,
+  italic, strike, heading cycle, quote, code, lists, rule, link box, Insert
+  file), Ctrl+B/I/K, list continuation on Enter, and a Write/Preview toggle
+  that POSTs the text to `/b/{sub}/preview` (`handlePreview`: `markdown.Render`
+  → `{html}`, nothing stored). Every edit goes through one `replace()` built on
+  `execCommand("insertText")` so browser undo works. The toolbar is `hidden`
+  until the script runs; without JS it is a bare textarea + "Insert file" +
+  cheat-sheet, and paste/drop take any file. Forms using it must be
+  `multipart/form-data` and their save handler must call
+  `s.readUpload(r, "inline_file", false)` + `appendFileMD` (the no-JS path).
 - **Announcements** (`sections` table, `store/sections.go`,
   `handlers_sections.go`, `/b/{sub}/announcements…`): per-blog notices with
   `placement` (`<column>-<position>`: left|main|right × top|bottom, split by