fix: 修复学生代码窃取 token、提示词链 XSS 和打分没有上限的问题

- 运行提交代码的 iframe（编辑器预览、随机评分弹窗、/submission/:id、全屏预览）
  加上 sandbox，不给 allow-same-origin，代码读不到 localStorage 里的 token
- 提示词和 AI 回复的 markdown 渲染时转义原始 HTML，链接只放行 http(s)/mailto；
  ChainModal 也改用这个渲染函数
- 打分限定 1-5 分（超出返回 422），不能给自己的提交打分

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/routes/submission.ts

@@ -530,9 +530,10 @@ router.post("/:id/view", (c) => {
 router.put("/:id/score", async (c) => {
   const user = requireUser(c)
   const id = uuidParam(c, "id")
-  const { score } = await body(c, z.object({ score: z.number().int() }))
+  const { score } = await body(c, z.object({ score: z.number().int().max(5) }))
   if (score <= 0) throw new HttpError(400, "分数不能为零")
-  orNotFound(get(`SELECT 1 FROM submission_submission WHERE id = $id`, { id }))
+  const sub = orNotFound(get<{ user_id: number }>(`SELECT user_id FROM submission_submission WHERE id = $id`, { id }))
+  if (sub.user_id === user.id) throw new HttpError(400, "不能给自己的提交打分")
 
   const exists = get(`SELECT 1 FROM submission_rating WHERE user_id = $user_id AND submission_id = $id`, {
     user_id: user.id,

server/tests/api.test.ts

@@ -136,6 +136,10 @@ describe("评分", () => {
     const again = await (await client("s0"))("PUT", `/api/submission/${uuid(sub)}/score`, { score: 1 })
     expect(again.json.message).toBe("你已经给这个提交打过分了")
     expect((await (await client("s0"))("PUT", `/api/submission/${uuid(sub)}/score`, { score: 0 })).status).toBe(400)
+    expect((await (await client("s1"))("PUT", `/api/submission/${uuid(sub)}/score`, { score: 6 })).status).toBe(422)
+    const self = await (await client("author"))("PUT", `/api/submission/${uuid(sub)}/score`, { score: 5 })
+    expect(self.status).toBe(400)
+    expect(all(`SELECT 1 FROM submission_rating WHERE user_id = $id`, { id: author })).toEqual([])
   })
 })