feat: add BlogBodySanitizer for HTML sanitization on article save

- Implemented BlogBodySanitizer to clean HTML content before saving articles, ensuring security against XSS attacks.
- Added tests for BlogBodySanitizer to verify that unsafe tags and attributes are stripped from the content.
- Introduced ApiLeastPrivilegeTest to ensure that unauthorized users cannot access sensitive API routes, maintaining strict access control.

config/services.yaml

@@ -118,6 +118,11 @@ services:
             $terminalId: '%env(default::MELLAT_TERMINAL_ID)%'
             $username:   '%env(default::MELLAT_USERNAME)%'
             $password:   '%env(default::MELLAT_PASSWORD)%'
+            # اعتبارنامهٔ نمایشیِ banktest.ir — عمومی است، ولی از `src/` بیرون
+            # کشیده شد تا در کد رشتهٔ پسوردمانند نماند (آدیت ۲۰۲۶-۰۸-۰۷).
+            $sandboxTerminalId: '%env(default::MELLAT_SANDBOX_TERMINAL_ID)%'
+            $sandboxUsername:   '%env(default::MELLAT_SANDBOX_USERNAME)%'
+            $sandboxPassword:   '%env(default::MELLAT_SANDBOX_PASSWORD)%'
 
     App\Payment\Gateway\SepGateway:
         arguments: