Add an HTML mode to posts, page intros and announcements

Markdown is the default and unchanged; the editor's new Format switch
stores the text as raw HTML instead, put on the blog exactly as written.
Like the custom HTML module it is unsanitised on purpose: the escape
hatch for embeds, scripts and inline styles that Markdown cannot express.

The source column keeps holding the text in both modes and a `format`
column says how to read it, so the public templates and the feed still
print the stored `*_html`. The dashboard preview of HTML goes into a
sandboxed iframe rather than the page, because a superadmin edits other
people's blogs and their markup must never run on the dashboard origin.
Search snippets of HTML posts are cut from a tag-stripped copy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 13 insertions, 0 deletions

diff --git a/internal/web/search_test.go b/internal/web/search_test.go
index 6a9b0a5..6ced39b 100644
--- a/internal/web/search_test.go
+++ b/internal/web/search_test.go
@@ -4,6 +4,8 @@ import (
 	"regexp"
 	"strings"
 	"testing"
+
+	"github.com/gramanas/blogspace/internal/store"
 )
 
 func TestSearchPattern(t *testing.T) {
@@ -42,3 +44,14 @@ func TestSearchSnippet(t *testing.T) {
 		t.Errorf("title-only snippet: %q", got)
 	}
 }
+
+func TestSnippetSource(t *testing.T) {
+	p := &store.Post{Format: store.FormatHTML, BodyMD: `<p class="x">Tom &amp; <b>Jerry</b></p><script>alert(1)</script>`}
+	if got := snippetSource(p); got != "Tom & Jerry" {
+		t.Errorf("html post: %q", got)
+	}
+	p.Format = store.FormatMarkdown
+	if got := snippetSource(p); got != p.BodyMD {
+		t.Errorf("markdown post is used as written: %q", got)
+	}
+}