[H-22] Markdown html_input => allow lets raw HTML into the purifier

Resolved.

Tightened MarkdownService so CommonMark no longer trusts raw HTML as input (src/Services/MarkdownService.php):

• Both toHtml() and toSignatureHtml() now set 'html_input' => 'escape'. Raw HTML in user input is HTML-escaped at the Markdown layer instead of being passed through to HTMLPurifier.
• BBCode pass was moved AFTER Markdown in toHtml(). text has no HTML meaning so it survives Markdown's escape, then BbcodeParser::toHtml() converts it to <b>text</b> for the purifier. Users keep their BBCode + Markdown formatting; raw <script> becomes harmless text.
• HTMLPurifier remains the final pass on everything.

Test suite: 93/93 pass, all MarkdownService tests green (bold/italic/bbcode-bold/bbcode-italic/bbcode-url/script-strip).

This closes the "wide attack surface" aspect — any future CommonMark or HTMLPurifier bypass now has two layers to break instead of one.

Locking this thread.