fix(classes): keep raw HTML in content_html behind the safety gate

- FormatHTML renders with goldmark html.WithUnsafe(), as Winter's
  Markdown::parse passes raw HTML through, so an admin save, an import or
  an API write no longer turns imported HTML into raw HTML omitted
- rejectUnsafe still runs after the render and refuses script, iframe,
  object and embed tags, event handlers and javascript, vbscript and data
  URLs; API response shapes are unchanged
- TestFormatHTMLKeepsRawHTML covers HTML paragraphs and a raw footer

classes/format_html_test.go

@@ -56,6 +56,28 @@ func TestFormatHTMLRejectsUnsafeHTML(t *testing.T) {
 	}
 }
 
+// TestFormatHTMLKeepsRawHTML pins D-03: raw HTML in content passes through
+// unchanged, as Winter's Markdown::parse does, so an imported HTML body
+// survives an admin save, an import or an API write.
+func TestFormatHTMLKeepsRawHTML(t *testing.T) {
+	const paragraphs = "<p>Grzyby rosną w lesie.</p>\n<p>Druga <b>część</b>.</p>"
+	out, err := FormatHTML(paragraphs)
+	if err != nil {
+		t.Fatalf("html paragraphs: %v", err)
+	}
+	if strings.TrimSpace(out) != paragraphs {
+		t.Fatalf("html paragraphs changed:\n%s", out)
+	}
+
+	mixed, err := FormatHTML("# Tytuł\n\nTekst.\n\n<footer class=\"author\">Autor</footer>")
+	if err != nil {
+		t.Fatalf("markdown with a raw footer: %v", err)
+	}
+	if !strings.Contains(mixed, "<h1>Tytuł</h1>") || !strings.Contains(mixed, `<footer class="author">Autor</footer>`) {
+		t.Fatalf("raw footer was dropped:\n%s", mixed)
+	}
+}
+
 // TestJournalEndToEnd keeps `go test ./... -run TestJournalEndToEnd`
 // from reporting [no tests to run] in this package.
 func TestJournalEndToEnd(t *testing.T) {}