Harden client against XSS and supply-chain risk

[Fristender]

• Fix XSS in Markdown rendering by sanitizing output (was marked.parse(...) on untrusted post/comment content).
• New sanitizer: src/markdown.ts
• Switched templates to use it: src/templates/post.ts, src/templates/feed.ts
• Remove third-party CDN dependencies (supply-chain/privacy risk) and serve vendored assets locally.
• Vendored: src/assets/vendor/pico.min.css, src/assets/vendor/htmx.min.js
• Layout updated: src/templates/layout.ts
• Static asset server + path traversal guard: src/index.ts
• Stop leaking secrets in UI + reduce persistence risk.
• API key no longer displayed in full (masked): src/templates/settings.ts
• Removed plaintext credentials write to ~/.config/moltbook/credentials.json: src/routes/auth.ts
• Bind the local server to localhost by default (HOST=127.0.0.1) and add basic security headers (CSP, nosniff, no-referrer, etc.): src/index.ts
• Add GitHub Actions release workflow to build + zip binaries (includes assets/) for Win/macOS/Linux: .github/workflows/release.yml