Give the editor a Markdown toolbar and preview, restyle the dashboard

The post/page/announcement editor was a bare textarea, so bloggers had to
know the Markdown syntax by heart. It now has a toolbar (bold, italic,
strike, heading cycle, quote, code, lists, rule, link box, insert file),
Ctrl+B/I/K, list continuation on Enter and a Write/Preview toggle that
renders the text through the same goldmark + bluemonday pipeline a save
uses (POST /b/{sub}/preview; nothing is stored). Every edit goes through
execCommand("insertText") so browser undo keeps working. The toolbar
stays hidden without JavaScript, leaving the old form untouched.

The dashboard moves from the "paper & ink" look to a lean one: neutral
surfaces, 1px borders, one blue accent, system sans, with custom
properties and flexbox/grid now allowed there (blog.css is unchanged).
Class names were kept so the templates barely change; a global [hidden]
rule keeps flex containers from overriding the hidden attribute.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 19 insertions, 0 deletions

diff --git a/internal/web/web_test.go b/internal/web/web_test.go
index e2bd335..9520953 100644
--- a/internal/web/web_test.go
+++ b/internal/web/web_test.go
@@ -1,6 +1,7 @@
 package web
 
 import (
+	"encoding/json"
 	"io/fs"
 	"net/http"
 	"net/http/httptest"
@@ -444,6 +445,24 @@ func TestFileMarkdown(t *testing.T) {
 	}
 }
 
+func TestPreviewRendersMarkdown(t *testing.T) {
+	s := NewServer(&config.Config{BaseDomain: "example.com", JWTSecret: []byte("x")}, nil)
+	req := httptest.NewRequest("POST", "/b/www/preview", strings.NewReader("body=**x**+<script>1</script>"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	s.handlePreview(rec, req)
+	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
+		t.Errorf("content type %q", ct)
+	}
+	var out map[string]string
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if h := out["html"]; !strings.Contains(h, "<strong>x</strong>") || strings.Contains(h, "<script>") {
+		t.Errorf("unexpected preview %q", h)
+	}
+}
+
 func TestNormalizeSection(t *testing.T) {
 	sec := &store.Section{Placement: "footer", Style: "<script>"}
 	normalizeSection(sec)