Summary by cubic

Hardened markdown by trusting only real KaTeX output and stripping inline styles elsewhere. Also enabled cross‑origin links/images and set a default origin to resolve relative URLs.

• New Features

  • Allow cross‑origin links and images; pass defaultOrigin=https://tracecat.local to all Streamdown instances for path‑relative URLs.

• Bug Fixes

  • Strip all inline styles outside trusted KaTeX trees; inside KaTeX, allow only a small set of style properties/values and canonicalize them.
  • Extend sanitize schema with MathML/SVG tags and safe attributes; rely on Streamdown’s built‑in KaTeX; add tests for style stripping and filtering.

^{Written for commit 69fbb94. Summary will update on new commits.}