emrg: gui — tiptap composer Stage 2 (format bar, shortcuts, paste sanitize)

[argszero]

Summary

Stage 2 of the tiptap composer work (rant 2026-08-28T14:07:29, Stage 1 merged in #1062). Adds a mini format bar, keyboard shortcuts, and DOMPurify paste sanitization to the React renderer composer.

Changes

• Mini format bar (fmt-bar toolbar above the composer): bold / italic / strike / inline code / link / bullet list / ordered list / blockquote / heading buttons
  • Heading button is a single-button four-state cycle: p → h1 → h2 → h3 → p
  • onMouseDown preventDefault keeps the text selection when clicking (commands act on selected text)
  • Active-state highlight via useEditorState (reactive to editor transactions)
• Keyboard shortcuts: ⌘B / ⌘I / ⌘⇧S / ⌘E / ⌘⇧B / ⌥⌘1-3 come from StarterKit's built-in keymap; ⌘K (link prompt), ⌘⇧8 (bullet list), ⌘⇧7 (ordered list) are explicitly wired (the native Mod-Shift-7/8 bindings break in real browsers because Shift+8 produces key *, so the handler matches event.code Digit7/Digit8)
• Paste sanitization: transformPastedHTML runs pasted HTML through DOMPurify (strips script tags and event handler attributes) — closes the XSS-in-paste path for the HTML paste route
• i18n: 11 new keys (zh + en), dict 375 → 386
• Tests: 16 new Composer tests (format bar, shortcuts, paste sanitize, selection retention); renderer suite now 467 tests across 44 files, all green

Verification

• cd emrg/gui/renderer && npx tsc --noEmit — clean
• Renderer: 44 files / 467 tests pass
• cd emrg/gui && npm test — 95 tests, 87 pass / 8 skip (theme-guard 2/2)
• uv run pytest tests/ — 1147 passed, 1 skipped (incl. doc-count guard, Agent.md synced to 467)

[argszero]

✅ LGTM — cycle cyc20260828-154602

Reviewed fresh: head 26909db unchanged, CI test + test-windows both green (33152273760), MERGEABLE/CLEAN. Full diff re-inspected:

• Composer.tsx: cycleHeading reads level via doc.resolve(from).parent (robust against tiptap v3 mixed-selection isActive false-negatives); Mod-Shift-7/8 wired via event.code Digit7/Digit8 with a documented rationale (real browsers map Shift+8 → key '*', breaking the native binding); transformPastedHTML → DOMPurify.sanitize closes the HTML-paste XSS path; onMouseDown preventDefault preserves selection.
• CSS: all var(--*) theme tokens, theme-guard 2/2 passes.
• i18n: 11 new keys zh/en aligned, parity guard 375 → 386 consistent.
• Tests: 16 new cases; assertions target markdown output instead of unreliable isActive (both positive and negative states covered, e.g. heading cycle ends back at paragraph with no '#' prefix).
• Agent.md: renderer count synced 451 → 467 (doc-count guard green).

Local verification (this cycle, on master + PR head): renderer 44 files / 467 tests pass, tsc --noEmit clean, GUI 95 (87 pass / 8 skip), pytest 1147 passed + 1 skipped. No issues found.

[argszero]

✅ LGTM — cycle cyc20260828-155322

Re-verified: head 26909db unchanged since LGTM 1/3 (cyc20260828-154602), CI test + test-windows still green (33152273760), MERGEABLE/CLEAN, no ❌ in history. No new commits or reviews since the prior vote — prior fresh-diff review (6 files, +416/−9: format bar, ⌘K/⌘⇧7/⌘⇧8 shortcuts, DOMPurify paste sanitization, cycleHeading via doc.resolve(from).parent, markdown-output test assertions, Agent.md 451→467 sync) remains valid. LGTM 2/3.

[argszero]

✅ LGTM — cycle cyc20260828-160007

Re-verified: head 26909db unchanged, CI test + test-windows green (33152273760), MERGEABLE/CLEAN. Review history: LGTM 1/3 (cyc20260828-154602) + LGTM 2/3 (cyc20260828-155322), no ❌ — 3 consecutive approvals from distinct cycles. Merging.