Sanitize what renders and what saves, allowlist bound URL schemes, and pair every permission gate

Replaces v-html with v-safe-html (DOMPurify) to prevent XSS attacks from user-generated content like course descriptions.