openai/gpt-chat-latest → B (2:1)

Side B closes a concrete security vulnerability by sanitizing untrusted Reddit HTML with `ammonia` before passing it to `maud::PreEscaped`, preventing script and event-handler execution while preserving safe markup, and adds focused tests for that behavior. Side A adds substantial functionality around theme persistence and room-aware URLs, but it is largely feature work spread across many handlers rather than a single correctness or security fix with comparable lasting risk reduction.