fix(notes): sanitize rendered Markdown HTML (XSS)

[iuyua9]

Summary

• sanitize rendered Markdown at the shared mdToHTML boundary before it is marked as trusted template HTML
• cover both note and journal views without changing stored content
• add malicious-input and common-Markdown regression tests

Security impact

User-authored Markdown was passed through template.HTML without an HTML policy, allowing stored script, event-handler, iframe, and javascript-URL payloads. bluemonday.UGCPolicy removes those unsafe constructs while retaining standard Markdown formatting.

Validation

• go test ./api/v1 -run TestMdToHTML -count=1
• go test ./... -run '^$'
• go vet ./...
• git diff --check

Closes #25