fix(learner): review round 1: sanitize-html, sandboxed runner frame, one visibility rule, no Tab capture

C1: lesson HTML goes through a sanitize-html allowlist on the fully rendered output (no on* attributes, no
style, no svg/math/iframe/object/embed/form; URLs limited to http(s), mailto, relative and anchors). Raw tags
outside the allowlist are escaped as text. The SPA document is served with a CSP (script-src 'self', no inline
script) through spaWithCsp in main.ts; contract request §5 asks core to own it.

C2: exercises run in <iframe sandbox="allow-scripts"> (opaque origin, no cookies) loaded from
/api/learner/runner-frame, whose CSP allows only its own script (by hash) and blob: workers, and connect-src
'none'. postMessage only, both sides check event.source; the timeout removes the frame. The worker stubs now
also cover Worker, SharedWorker and caches.

I1: learner visibility calls core canView with per-course authorship only, like /api/media (contract request §6).
I2: Tab and Shift+Tab move focus; Enter keeps the previous line's indentation.

Tests: XSS unit cases, headless-Chrome checks for the exploit lesson and for fetch, import, Cache.add, nested
Worker, img, EventSource, WebSocket, XHR and sendBeacon from learner and test code (plus a negative control),
visibility on both dialects, SPA and runner-frame CSP headers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-learner/test/lesson-view.test.tsx

@@ -106,3 +106,12 @@ test("helpers: local command per track, note timestamps, code tree", () => {
   expect(t.dirs.get("src")!.files.map((f) => f.path)).toEqual(["src/b.ts"]);
   expect(t.dirs.get("src")!.dirs.get("x")!.files[0]!.path).toBe("src/x/c.ts");
 });
+
+test("the exercise editor: no Tab capture, Enter keeps the indentation", async () => {
+  const { newlineWithIndent } = await import("../src/web/lesson/Exercise");
+  expect(newlineWithIndent("function f() {\n    return 1", 26)).toBe("\n    ");
+  expect(newlineWithIndent("x", 1)).toBe("\n");
+  expect(newlineWithIndent("\t\tx", 3)).toBe("\n\t\t");
+  const src = await Bun.file(new URL("../src/web/lesson/Exercise.tsx", import.meta.url)).text();
+  expect(src).not.toMatch(/e\.key === "Tab"/);
+});