Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/tests/modules/content/test_content_sanitize_protocols.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from app.modules.content.service import sanitize_html
+
+
+def test_sanitize_html_strips_javascript_protocol():
+    raw = '<a href="javascript:alert(1)">x</a><img src="javascript:alert(1)" alt="x" />'
+    clean = sanitize_html(raw)
+    assert "javascript:" not in clean