Read a Markdown file as the document it is

A .md previewed as its own source, which is reading the punctuation
rather than the notes. It now opens rendered, with Rendered | Source in
the dialog footer for anyone who wants what the file actually says.
Markdown only; a .txt has nothing to toggle between.

Rendering is `marked`, sanitised by DOMPurify -- the one the app already
carries for mail. Markdown is not a safe subset of anything: raw HTML
passes through it by design, so a <script> in a file somebody uploaded or
shared into the account is a script tag unless something takes it out.

Images become links rather than pictures. An image in a Markdown file is
either a relative path, which has no base to resolve against here, or a
URL somewhere else, which fetches on open and tells that server the file
was read -- the tracking pixel this app blocks in mail. The link keeps
the alt text and the address, so nothing vanishes silently.

Fixes the PDF preview while here, which never worked: securityHeaders
put X-Frame-Options: DENY on every response including the blob route, so
the iframe showed Chrome's "refused to connect" where the file should
have been -- in Files today and in mail attachments long before that.
The middleware now leaves a header the route has set, and a PDF served
inline says SAMEORIGIN. Nothing else on the server is framable.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "ihasmail",
-  "version": "2.0.0",
+  "version": "0.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ihasmail",
-      "version": "2.0.0",
+      "version": "0.0.0",
       "license": "AGPL-3.0-or-later",
       "workspaces": [
         "server",
@@ -2321,6 +2321,18 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/marked": {
+      "version": "18.0.11",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.11.tgz",
+      "integrity": "sha512-HnslJfsZkRPBDJRHvVtAaWlZHEpSu7u8LgQuJCELjRKuWR+hpq4A7sLq3p8HaI9ypVoXDXxV34CsQJEe1+J5Aw==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
     "node_modules/mitt": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/mitt/-/mitt-3.0.1.tgz",
@@ -3814,7 +3826,8 @@
     },
     "server": {
       "name": "@ihasmail/server",
-      "version": "2.0.0",
+      "version": "2.16.0",
+      "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@hono/node-server": "^1.13.8",
         "hono": "^4.7.4"
@@ -3827,11 +3840,13 @@
     },
     "web": {
       "name": "@ihasmail/web",
-      "version": "2.0.0",
+      "version": "0.0.0",
+      "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@tanstack/react-virtual": "^3.13.2",
         "dompurify": "^3.2.4",
         "lucide-react": "^0.477.0",
+        "marked": "^18.0.11",
         "qrcode-generator": "^2.0.4",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",