Adds a dedicated HtmlSvgRenderer that turns ```html / ```svg fences in
assistant messages into an inline preview with a Code/Preview tab
toggle. HTML runs inside an iframe with sandbox="allow-scripts" only
(no allow-same-origin, no allow-top-navigation) so JS games execute but
cannot reach parent.document. SVG is sanitized through DOMPurify with
the svg/svgFilters profile before being mounted via
dangerouslySetInnerHTML, stripping <script>, on* handlers, javascript:
URLs, and any tag that could escape the SVG sandbox.
The renderer defaults to the Preview tab for completed fences and
locks to the Code tab while the stream is still arriving so users see
partial tokens rather than a flashing preview. The Code tab keeps the
existing Streamdown syntax-highlighted view and the established copy /
download chrome from CodeBlockActions. HTML previews cap at 500px and
have a pop-out affordance that expands to 80vh; Esc exits the modal.
Wires the renderer into the markdown pipeline via the existing
StreamdownBlock fork in markdown-text.tsx, replacing the previous
stacked code+preview layout. Non-HTML / non-SVG fences fall through to
the original highlighted code block.
Adds Vitest + jsdom + React Testing Library to the frontend dev
dependencies and a vitest.config.ts. Covers: iframe sandbox attribute,
SVG script + onclick stripping, Code/Preview toggle, streaming lock,
DOMPurify behaviour on javascript: URLs and onload handlers, and that
non-HTML/SVG fences are not routed through the renderer.
83e67231cd