feat(embed): add raw HTML embed fence with bleach sanitization
- Add embed markdown fence: user pastes raw embed HTML code
(from Canva/YouTube/Google Docs Share→Embed) into lesson markdown
and slide content. Backend sanitizes via bleach (whitelist
tags/attrs/styles) + checks iframe src against domain blacklist
(SSRF prevention). Frontend renders iframe directly — no lazy
action needed.
- Backend: _process_embed_embeds + _sanitize_embed_html in
lesson_service.py, applied to lesson_content, exercise,
lesson_info, and slide loop. Graceful fallback if tinycss2
missing (CSS unsanitized but tags/attrs still stripped).
- Tests: 9 pytest cases (Canva/YouTube HTML, script stripping,
onclick stripping, blocked domain, non-https iframe, empty,
unchanged, dangerous style).
- Frontend: remove renderEmbedEmbeds.ts + wire-up + .generic-embed
CSS (URL-only approach from earlier iteration, superseded).
Keep .embed-error CSS for error messages.
- Example: update test_slides.md with raw HTML Canva embed (slide)
+ YouTube embed (body).
- Deps: bleach>=6.0.0, tinycss2>=1.2.0 in requirements.txt.
- Docs: consolidate 4 plan files into docs/06-embed-content.md.
a2nr
2a09ee77ab