Replace isomorphic-dompurify with dompurify, drop jsdom from production deps (#804)

Since DOMPurify is only used in a "use client" component (EntryContentBody),
it always runs in the browser where native DOM is available. This means we
don't need isomorphic-dompurify's jsdom-based server fallback.

- Replace `isomorphic-dompurify` with `dompurify` (uses native browser DOM)
- Remove `jsdom` from production dependencies (remains available via vitest)
- Reduces transitive dependency surface area (no more undici in production)

Closes #804

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

package.json

@@ -61,6 +61,7 @@
     "argon2": "^0.44.0",
     "concurrently": "^9.2.1",
     "discord.js": "^14.26.2",
+    "dompurify": "^3.3.3",
     "dotenv-cli": "^11.0.0",
     "drizzle-orm": "^0.45.2",
     "fast-xml-parser": "^5.5.9",
@@ -70,8 +71,6 @@
     "html-rewriter-wasm": "^0.4.1",
     "htmlparser2": "^10.1.0",
     "ioredis": "^5.9.3",
-    "isomorphic-dompurify": "^3.7.1",
-    "jsdom": "^29.0.1",
     "linkedom": "^0.18.12",
     "mammoth": "^1.11.0",
     "marked": "^17.0.3",

pnpm-lock.yaml

@@ -9,7 +9,7 @@
 
 import { useEffect, useRef, useMemo } from "react";
 import { useHotkeys } from "react-hotkeys-hook";
-import DOMPurify from "isomorphic-dompurify";
+import DOMPurify from "dompurify";
 
 // Configure DOMPurify to:
 // 1. Open all external links in new tabs