Images in a legal document render broken

[thoda-dev]

Version

a610064 (built from source, master after #28)

Deployment

Built from source

What happens, and what you expected instead

The legal pages documentation says the allowed Markdown includes images, and the parser allows img in its tag allowlist. In practice no image an operator can write will ever display.

There is nowhere to host one. The instance serves no user-supplied assets, and the app's CSP sets img-src 'self' data: blob:, so an external URL is refused by the browser. The parser also rejects data: URIs. What is left is a same-origin path, which only exists if you rebuild the image with a file added to public/.

The result is a broken image icon in the editor preview and on the published page, with nothing telling the operator why — the CSP refusal is silent.

Expected: the allowlist and the documentation describe what actually works, so an image is dropped rather than rendered broken.

Steps to reproduce

1. Sign in as super admin and open /admin/legal
2. Insert the privacy template and add ![logo](https://example.com/logo.png) anywhere in it
3. Look at the live preview, then save and open /legal/privacy
4. The image is a broken icon in both, and the browser console shows a CSP refusal

Relevant logs

Refused to load the image 'https://example.com/logo.png' because it violates the following Content Security Policy directive: "img-src 'self' data: blob:".