feat: optional Exoplanet.Sanitizer adapter (#24)

[milmazz]

Summary

Addresses the sanitizer-hardening item in #24: let consumers delegate HTML sanitization to a comprehensive library (e.g. html_sanitize_ex) for security-sensitive rendering — without making it a dependency.

• New public behaviour Exoplanet.Sanitizer — one callback sanitize(html) :: html. Activated globally via app env (mirrors Exoplanet.Cache):

  config :exoplanet, sanitizer_adapter: MyApp.FeedSanitizer

• Replace semantics — when an adapter is set and sanitize_html: true, it replaces the built-in sanitize walk (single source of truth). strip_images/excerpt_length still run after; sanitize_html: false disables sanitization entirely (adapter not called); nil/empty fields aren't passed to the adapter.
• No filter-map schema change — the adapter is app-env only, so @type t, @defaults, merge/2, and Config.from_file/1 are untouched.
• No new dependency — html_sanitize_ex is the documented example adapter, not added to mix.exs.
• Security fix found in review — strip_images rewrites <img> to <a href=src>. image_src/2 previously skipped the scheme allowlist when the pass ran with sanitize?: false (the strip-only and post-adapter paths), so an <img src="javascript:..."> could become a clickable javascript: link. The generated <a href> is Exoplanet's own construct, so safe_url?/1 is now enforced unconditionally. Regression tests added for both paths.

Docs: Exoplanet.Sanitizer + Exoplanet.Filters moduledocs, README "stronger sanitization" example, CHANGELOG, CLAUDE.md.

Test Plan

• mix precommit (compile, format, deps.unlock, docs, test) — 137 tests, 0 failures
• New test/exoplanet/filters_sanitizer_test.exs: replace, skip-when-false, per-field/empty-skip, strip-after-adapter ordering, no-adapter-unchanged, and the javascript:-href regression
• No-adapter path unchanged (test/exoplanet/filters_test.exs green)
• No html_sanitize_ex dependency added (mix.exs/mix.lock unchanged)

Refs #24

🤖 Generated with Claude Code