[codex] Secure markdown reader and split app

[honestTai]

Summary

• Harden Markdown rendering with DOMPurify and restore a strict Tauri CSP.
• Scope Tauri file commands to registered Markdown workspaces and remove unused file-read command exposure.
• Add CI coverage for pnpm lint/build/audit and Rust fmt/clippy/test.
• Split App.tsx concerns into i18n, reader state, export helpers, library/search, and extracted library/quick-open UI modules.
• Keep quick-open search isolated from the sidebar search, and clear stale sidebar search when switching to Favorites or Pinned.

Validation

• npx --yes pnpm@10.24.0 lint
• npx --yes pnpm@10.24.0 build
• npx --yes pnpm@10.24.0 audit --audit-level high
• cargo fmt --all --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all
• Browser smoke test at http://localhost:1420/?demo=1, with no console errors.