Render markdown in OpenAPI descriptions on the API pages

[vzert]

Problem

Operation, tag, parameter and response descriptions are rendered as
plain text. So a spec description like:

Create a **payment**. See the [pricing guide](/pricing) and the
`amount` field below.

shows up in the docs with the literal **, […](…) and backticks
instead of formatting.

Fix

A small mdToHtml helper (lib/md-desc.ts, remark + rehype) used on the
server-rendered API pages:

• operation description + per-response descriptions (operation-page.tsx)
• parameter / schema attribute descriptions (schema-table.tsx)
• tag descriptions (endpoint-list.tsx)
• mdToText for the page <meta> / OG description, so markdown syntax
  doesn't leak into search snippets (page.tsx)

Safety

The rendered HTML is injected via dangerouslySetInnerHTML, so it is
sanitized:

• Raw HTML in the source is dropped — no rehype-raw, so a
  <script> / <img onerror> in a description never reaches the output.
• Unsafe URL schemes are stripped — rehype-sanitize (default GitHub
  schema) turns [x](javascript:alert(1)) into inert <a>x</a> while
  keeping normal https: links, code, tables and lists.

Verified end-to-end: injected a description with bold, a javascript:
link and a GFM table into a spec, built, and confirmed the page renders
<strong>/<code>/<table> and that the javascript: href is gone.

Scope

Intentionally limited to the server-rendered operation/tag pages. The
interactive apiref view (markline-apiref) also renders descriptions,
but rendering markdown there is an HTML-injection / sanitization design
call I'd rather leave to you — glad to send a follow-up once you're happy
with the approach here.

Dependencies

Adds direct deps: unified, remark-parse, remark-rehype,
rehype-sanitize, rehype-stringify. remark-gfm was already present.

Verification

• npm run typecheck — clean
• npm test — 25/25 pass (adds test/md-desc.test.ts)
• npm run build — static export succeeds

[oreofeolurin]

The sanitization work here is solid. I checked the output myself: [x](javascript:alert(1)) comes out as an inert <a>, raw <img onerror> and <script> get dropped, and mdToText gives clean meta descriptions. Tests and typecheck pass, static export builds fine.

On the apiref view, the approach is right and there's no design call left to make. mdToHtml with rehype-sanitize and no rehype-raw is exactly what I'd want there too, so go ahead and run the same pipeline over r.lead and the operation leads in markline-apiref.tsx.

The reason I'd rather have that in this PR than a follow-up: /api-reference/<tag> is the page people actually land on, and it renders MarklineApiRef, not ApiOperationPage. The operation page only comes up on per-operation deep links. So as it stands a tag description with **bold** and a [link](…) still renders literally on the resource page, and most readers see no change at all.

Two things worth fixing while you're in there:

• .api-desc a has no colour set, so links fall through to the browser default #0000EE. Against the dark theme background that's about 1.3:1.
• Response descriptions go into a <span> (operation-page.tsx:180), so a description containing a list emits <p>/<ul> inside a span in a flex row. Invalid nesting, and the status pill drifts out of alignment. A div sorts it, and mdToHtml already unwraps single paragraphs so inline descriptions stay inline.