feat: add BlogBodySanitizer for HTML sanitization on article save

- Implemented BlogBodySanitizer to clean HTML content before saving articles, ensuring security against XSS attacks.
- Added tests for BlogBodySanitizer to verify that unsafe tags and attributes are stripped from the content.
- Introduced ApiLeastPrivilegeTest to ensure that unauthorized users cannot access sensitive API routes, maintaining strict access control.

.claude/skills/qa-clinicpro/driver.mjs

@@ -33,12 +33,17 @@ const PORT = Number(process.env.CDP_PORT ?? 9444);
  * provisioned by SKILL.md § Phase 0 and report `✗` from `driver.mjs roles`
  * until they are. TEST_USERS.md is stale — its accounts do not exist.
  */
+// Re-verified 2026-08-07 by real logins: the DB was reseeded, so the old clinic
+// and secretary numbers are gone and 09390039833 is now ROLE_CLINIC, not doctor.
+// `staff` was seeded with its mobile as the password rather than QaTest@1234.
 const ROLES = {
   admin: ['09120671756', 'QaTest@1234'],
-  clinic: ['09127000000', 'QaTest@1234'],
-  secretary: ['09123456778', 'QaTest@1234'],
-  doctor: ['09390039833', 'QaTest@1234'],
+  clinic: ['09390039833', 'QaTest@1234'],
+  secretary: ['0912000109', 'QaTest@1234'],
+  doctor: ['0912000101', 'QaTest@1234'],
   representation: ['09124000001', 'QaTest@1234'],
+  staff: ['09128726723', '09128726723'],
+  multirole: ['0912000201', 'QaTest@1234'],
 
   // Provisioned by Phase 0. Reserved QA range 0912900000x, password QaTest@1234.
   doctor_solo: ['09129000001', 'QaTest@1234'],       // own office, no clinic