sanitize rich text + Tiptap editors everywhere

Consolidates every user-generated HTML surface onto a single sanitized renderer and swaps every plain <Textarea> composer for the Tiptap rich-text editor.

Security hardening

• New lib/sanitize helper (DOMPurify-backed, with UGC + rel=nofollow link hints, HMR-safe hook registration).