Document DOMPurify security rationale and evaluate img tag privacy risk #196

Source

PR #191 review threads:

• img tag privacy risk
• security rationale undocumented

Problems

1. <img> tag enables external tracking: User-generated content (news articles, game descriptions) could embed <img src="https://attacker.com/track"> to exfiltrate IP addresses. If images are not strictly needed, remove from allowlist. If needed, add Content Security Policy or image proxy.

2. Security rationale undocumented: The allowlist decisions (why img included, why style/on*/script excluded, why class/id permitted) should be documented in code comments for maintainability.

Fix

// Security: Allowed HTML tags for user-generated content rendering.
// - img: allowed for Markdown image syntax; be aware of privacy implications
//   (external image tracking). Mitigate with CSP or image proxy if needed.
// - script, style, iframe, form, input, object, embed: intentionally excluded
//   to prevent XSS and UI redressing.
// - class, id: permitted for styling; sanitized by DOMPurify defaults.
const ALLOWED_TAGS = [...]

Relates: #191