fix(legal): drop img from the allowed markdown tags

[thoda-dev]

What this changes

Closes #29

Removes img from the tag allowlist in shared/utils/legal-markdown.ts, along with the now-pointless allowDataImages: false and the image rule in the legal document stylesheet. The documentation stops listing images among the allowed Markdown.

Why

An operator has nowhere to host an image. The instance serves no user-supplied assets, and the CSP sets img-src 'self' data: blob:, so an external URL is refused by the browser and a data: URI was already rejected by the parser. Everything an operator could realistically write rendered as a broken icon, in the editor preview and on the published page alike, with a silent CSP refusal as the only explanation.

Dropping the tag makes the allowlist describe what actually works. Nothing is lost: no shipped template uses an image, and a document that contains one now loses the image rather than showing it broken.

This came out of a Copilot review on #28, which framed it as a security mismatch. It is not one — the CSP refusing external images is the intended layered defence, and the parser is the second layer. The reason to remove the tag is that it cannot work, not that it is unsafe.

Checks

• pnpm lint, pnpm typecheck and pnpm test pass
• Schema change? A migration is committed alongside it (pnpm db:generate)
• Touches crypto, authorization, or the paste read counter? Say so here — those get a closer read

No schema change, no crypto, no authorization, no read counter. It narrows an existing allowlist, so the change can only reject more than before. A test covers both a relative and a remote image being dropped.

AI assistance

See CONTRIBUTING.md. Disclosure is not held against you: it tells
the reviewer where to look hardest.

• No AI tool was used
• An AI tool was used — which one, and roughly how much of the change: Claude Code, all of it. Four lines removed, one test added.

[Copilot]

🟢 Approval recommended

The functional change is a straightforward allowlist narrowing with corresponding docs and tests, and the remaining feedback is minor wording accuracy.

Pull request overview

This PR aligns the legal-document Markdown allowlist and documentation with what instances can realistically render by removing image support end-to-end (parser allowlist, docs, and styling), and adds a regression test to ensure images are dropped.

Changes:

• Remove img from the legal Markdown allowed tag list and drop the now-unused allowDataImages setting.
• Update self-hosting documentation to no longer claim images are allowed in legal pages.
• Remove legal-document image styling and add a test asserting images are dropped.

File summaries

File	Description
apps/docs/content/2.self-hosting/5.legal-pages.md	Updates docs to remove images from the stated allowed Markdown set.
apps/app/tests/legal-markdown.test.ts	Adds a regression test ensuring image syntax doesn’t produce <img> nodes.
apps/app/shared/utils/legal-markdown.ts	Removes img from the Markdown sanitizer/tag allowlist and simplifies security plugin options.
apps/app/app/components/LegalDocument.vue	Removes CSS targeting images inside legal documents.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.