~anthropic/claude-sonnet-latest → A (6:4)

Side A fixes a real XSS vulnerability by sanitizing untrusted Reddit HTML before rendering, a small, precise, security-critical change with tests. Side B is a large refactor consolidating POST /post, /post/check, /post/redact into a single /ui RPC endpoint—useful cleanup but riskier, sprawling, and not addressing a correctness/security defect.