feat(image): support local Markdown image embeds

[ELEVENBLACK41]

Summary / 摘要

Add secure local image rendering for standard Markdown images and Obsidian-style image embeds in the Electron demo.

为 Electron Demo 增加本地 Markdown 图片和 Obsidian 图片嵌入的安全渲染能力

Motivation / 背景与动机

I regularly use Obsidian to write and manage Markdown notes. After running Nexus Editor and opening one of my local Obsidian Vaults, I found that common Obsidian image embeds such as ![[Pasted image.png]] were displayed as unresolved references instead of rendered images.

Before this change, local image references were treated as ordinary renderer-relative URLs, so images stored in Vault attachment folders could not be displayed. This exposed a compatibility gap between Nexus Editor's live preview and Obsidian-style Markdown syntax.

This change resolves local images relative to the active Markdown file, falls back to a unique matching image basename inside the current Vault, and loads the final bytes through the scoped nexus-vault:// resource protocol without exposing absolute filesystem paths.

• Issue: N/A
• Roadmap (docs/ROADMAP.md): N/A
• OpenSpec change: add-local-image-embeds

Changes / 变更内容

• packages/core:

  • Recognize Obsidian image embeds such as ![[image.png]]
  • Support ![[image.png|width]]
  • Preserve the original Markdown source
  • Prevent image embeds from being rendered as ordinary navigable wiki links
  • Support image paths containing spaces
  • Add live-preview regression tests

• packages/plugin-*:

  • No changes

• apps/electron-demo:

  • Resolve image paths relative to the active Markdown file
  • Find a unique matching image basename inside the current Vault
  • Reject absolute paths, traversal attempts, unsupported schemes, and files outside the Vault
  • Add scoped nexus-vault:// resource loading for legacy and runtime modes
  • Revoke image resources when documents, widgets, Vault sessions, or editors are disposed
  • Preserve existing image hover, source, resize, and fallback behavior
  • Add sample Vault examples and Electron tests

• openspec/:

  • Add the add-local-image-embeds proposal, design, tasks, and spec

Testing / 测试

• pnpm typecheck
• pnpm build
• pnpm --filter @floatboat/nexus-electron-demo build
• New / updated vitest cases:
  • Core image range parsing
  • Obsidian image embed parsing
  • Wiki-link decoration regression
  • Relative and basename image resolution
  • Path traversal and unsupported URL rejection
  • Renderer resource cleanup
  • Legacy Electron resource URL creation and revocation
  • Runtime Vault basename lookup
• pnpm test passes / 全绿 fail与本次改动无关
• Manual UI check in electron-demo

Full test result: 900/911 tests passed. The remaining failures are environment-dependent Windows symlink permission tests and one performance-baseline test. No image-related test failures were observed.

Manual verification target:

1. Open apps/electron-demo/sample-vault as a Vault.
2. Open image-demo.md.
3. Verify both ![...](img/1.png) and ![[img/1.png]].
4. Verify a unique Pasted image.png under an attachment folder.
5. Verify ![[img/1.png|280]] renders with the requested width.

Compliance / 合规自检

• CLA signed — the CLA bot will prompt first-time contributors
• AI disclosure — describe AI assistance truthfully below

AI-assisted notes:

AI tools were used for repository exploration, design discussion, implementation assistance, test scaffolding, and review. I reviewed the final changes and can explain the path-resolution rules, Vault security boundaries, resource lifecycle, and test coverage.

• New dependencies: none
• No build artifacts committed
• No secrets / .env / personal Vault data committed

Checklist / 自检清单

• Title follows Conventional Commits
• No public package API change requiring README updates
• live-preview-table.ts was not touched; table-specific rules are not applicable
• OpenSpec change linked: add-local-image-embeds
• Change aligns with the project scope

Screenshots / Recordings · 截图或录屏

[CLAassistant]

All committers have signed the CLA.