GHSA-qxwq-q265-hc44

### Summary An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API.

### Details The TipTap editor sanitizes HTML client-side, but the backend stores raw HTML without server-side sanitization. The stored content is rendered via `v-html` in `TextArea.vue` through `NcMarkdownParser.parse()` which performs no sanitization.

### Impact Stored XSS — malicious scripts execute for any user viewing the cell.

### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).