Chat: Add chat message formatter - markdown to html

[goodtocode]

Chat: Add chat message formatter - markdown to html

Title
Guarantee consistent chat formatting across providers by normalizing Markdown -> safe HTML in Presentation.Web
Problem
Chat output formatting is inconsistent across providers/models (Azure OpenAI, Ollama, Foundry). Some responses include markdown-like content, but rendering currently appears as plain text in Presentation.Web, causing poor readability and provider-dependent UX.
Goal
Guarantee consistent display formatting regardless of provider/model by:

1. Defining a canonical message format contract (Markdown as canonical input format).
2. Rendering all assistant messages in Presentation.Web as sanitized HTML.
3. Ensuring fallback behavior when content is non-markdown/plain text.
   Scope
   • Frontend rendering path in src/Presentation.Web for chat messages.
   • Optional shared formatter abstraction in core/infrastructure if needed.
   • No provider-specific rendering logic in UI.
   Out of Scope
   • Prompt redesign for all agent behaviors (except minimal formatting hints).
   • Rich-text editor support for user-authored markdown.
   • Streaming protocol redesign.
   Requirements / Acceptance Criteria
   • [ ] Assistant messages render formatted output (headings, lists, code blocks, links, emphasis).
   • [ ] Behavior is consistent across Azure OpenAI, Ollama, and Foundry.
   • [ ] Output is sanitized (no unsafe HTML/script injection).
   • [ ] Plain text still renders safely and predictably.
   • [ ] Existing chat flows continue working (no regressions in send/receive/streaming).
   • [ ] Feature is covered by tests (unit + minimal UI/integration path).
   Proposed Technical Direction (native .NET first)
   • Use a .NET markdown parser/converter (prefer minimal, stable dependency if no BCL-native parser is available).
   • Wrap conversion behind an interface (e.g., IChatMessageFormatter) with implementation like MarkdownToHtmlFormatter.
   • Sanitize resulting HTML before rendering (MarkupString only after sanitization).
   • Keep UI renderer provider-agnostic.
   Security Notes
   • Never render raw model output directly as HTML.
   • Sanitize allowlist tags/attributes.
   • Validate link handling (target/rel behavior, disallow javascript: URIs).
   Test Plan
   • Unit tests for markdown conversion and sanitization edge cases.
   • Regression tests for plain text and malformed markdown.
   • Provider-path smoke tests to ensure identical formatting behavior for same markdown payload.
   Definition of Done
   • Merged implementation with tests and docs update.
   • Verified manually in Presentation.Web for representative chat responses and code blocks.