strip HTML from list-card preview + fix extractPlainText word fusion

Two fixes caught during browser testing of the rich-text homogenization PR (#553).

1. Threads list page was leaking raw HTML tags. Before this fix, frontend/app/tenant/[subdomain]/[communitySlug]/threads/page.tsx rendered {post.content.substring(0, 200)} directly into a CardDescription. This was safe when thread bodies were plain text, but after #553 switched authoring to Tiptap, newly-authored threads render in the list as <p>My thread</p> — tags visible to users. The fix routes through extractPlainText from lib/sanitize, matching the pattern already used on the announcements list, events list, search page, and every mobile tab.