feat: body links, outbound rules and image attributes in the post body

- renderJournalBody runs the UI-SPEC L7 order on the sanitized body:
  h1 demotion, the CMS phrase auto-links, the outbound rules and lazy,
  async images, with vue-seo-layer's autolink, applyOutbound and
  imageAttrs; PostBody feeds it the page's resolve answer (autolinks,
  autolink_max, outbound, url) and the seo.links.newTabHint option
- the sanitizer keeps a link rel of only nofollow, sponsored and ugc
  (the Blog Editor's link form, as the Journal plugin's policy does);
  target is never kept, the outbound rules add it
- editor-corpus.json copied again from sm-journal-plugin (link-rel and
  image-decorative entries)
- smoke:ssr script; expectations for auto-links, both new-tab modes and
  the hint switched off

testing/fixtures/acme/posts.json

@@ -5,7 +5,7 @@
     "slug": "hello-acme",
     "excerpt": "Acme says hello and introduces its blog.",
     "content": "## Welcome to Acme\n\nAcme builds anvils, rockets and very fast roller skates.\n",
-    "content_html": "<h2>Welcome to Acme</h2>\n<p>Acme builds anvils, rockets and very fast roller skates.</p>\n<figure data-embed=\"youtube\" data-id=\"dQw4w9WgXcQ\"></figure>\n",
+    "content_html": "<h2>Welcome to Acme</h2>\n<p>Acme builds anvils, rockets and very fast roller skates.</p>\n<figure data-embed=\"youtube\" data-id=\"dQw4w9WgXcQ\"></figure>\n<p>Read <a href=\"https://partner.test/review\" rel=\"ugc\">the review</a>, <a href=\"https://shop.ads.test/deal\">a deal</a> and <a href=\"/blog/acme-note-04\">an older note</a>.</p>\n<p><img src=\"/storage/app/uploads/public/acme/anvil.png\" alt=\"\" width=\"640\" height=\"480\"></p>\n",
     "reading_time": 1,
     "published": true,
     "published_at": "2026-01-14T09:00:00+00:00",
@@ -505,7 +505,7 @@
     "slug": "heading-off",
     "excerpt": "Heading Off Sample shows the Journal H1 setting off.",
     "content": null,
-    "content_html": "<h1>Body heading one</h1>\n<p>The body opens with its own top heading.</p>\n<h2>Body heading two</h2>\n<p>And continues below it.</p>\n",
+    "content_html": "<h1>Body heading one</h1>\n<p>The body opens with its own top heading.</p>\n<h2>Body heading two</h2>\n<p>And continues below it.</p>\n<p>See <a href=\"https://partner.test/x\" rel=\"ugc\">the partner</a> and <a href=\"https://other.test/y\">another site</a>.</p>\n",
     "reading_time": 1,
     "published": true,
     "published_at": "2025-12-19T09:00:00+00:00",

testing/fixtures/acme/seo/resolve.json

@@ -71,7 +71,39 @@
         "url": "https://acme.test/blog/hello-acme",
         "path": "/blog/hello-acme"
       }
-    ]
+    ],
+    "autolinks": [
+      {
+        "phrase": "Acme",
+        "url": "https://acme.test/blog/hello-acme"
+      },
+      {
+        "phrase": "Welcome",
+        "url": "/blog/acme-note-06"
+      },
+      {
+        "phrase": "roller skates",
+        "url": "/blog/acme-note-03"
+      },
+      {
+        "phrase": "rockets",
+        "url": "/blog/acme-note-05"
+      },
+      {
+        "phrase": "anvils",
+        "url": "/blog/acme-note-07"
+      }
+    ],
+    "autolink_max": 2,
+    "outbound": {
+      "new_tab": true,
+      "nofollow_domains": [
+        "partner.test"
+      ],
+      "sponsored_domains": [
+        "ads.test"
+      ]
+    }
   },
   "/blog/heading-on": {
     "action": "ok",
@@ -219,7 +251,14 @@
         "url": "https://acme.test/blog/heading-off",
         "path": "/blog/heading-off"
       }
-    ]
+    ],
+    "outbound": {
+      "new_tab": false,
+      "nofollow_domains": [
+        "partner.test"
+      ],
+      "sponsored_domains": []
+    }
   },
   "/blog": {
     "action": "ok",