feat: add DOMPurify XSS sanitization pipeline to client-side markdown renderer

- Vendored DOMPurify at static/vendor/purify.min.js, loaded with defer in base.html
- ContentRenderer.js now sanitizes marked output via DOMPurify.sanitize before processMedia
- Fail-closed: render() throws if DOMPurify is undefined instead of emitting unsanitized HTML
- Added _json_ld_dumps helper in seo.py to escape <>&\u2028\u2029 in JSON-LD output
- Updated combine() to use the new safe dumper for all schema.org payloads

devplacepy/templates/base.html

@@ -167,6 +167,7 @@
 
     <script defer src="/static/vendor/marked.umd.js"></script>
     <script defer src="/static/vendor/highlight.min.js"></script>
+    <script defer src="/static/vendor/purify.min.js"></script>
     <script type="module" src="/static/vendor/emoji-picker-element/index.js"></script>
     <script type="module" src="/static/js/Application.js"></script>
     {% block extra_js %}{% endblock %}