security(website): remove the browser PAT flow and restore safe dynamic rendering

Why this is a release blocker

The live website serves an older renderer that uses unsanitized innerHTML/Marked content while asking maintainers for a classic GitHub token with repo scope. A DOM-XSS issue in that page can expose a highly privileged credential.

Current dev is not a releasable fix: broad changes from HTML assignment to textContent cause template markup to display literally, break dynamic sections, and make the terminal query a missing .command-text element.

Evidence: website/index.html:775-787 and website/script.js:93-108,158-179,653-754.

Required work

• Disable/remove the browser-based classic PAT editor immediately.
• Use GitHub's normal authenticated web flow for content contributions, or design a narrowly scoped server-side integration separately.
• Render trusted templates with DOM APIs; sanitize all Markdown-derived HTML with an approved sanitizer.
• Validate all URLs and iframe/embed origins.
• Add a restrictive CSP that matches the actual asset and embedding model.

Acceptance criteria

• No GitHub credential is requested, stored or processed by the public website.
• Known HTML/Markdown/URL XSS payloads do not execute.
• Dynamic homepage, rules, docs, blog, events, releases, FAQ and playground content renders correctly.
• Playwright tests cover rendering, navigation, editor removal, CSP violations and an XSS regression corpus.
• Keyboard and axe checks run in CI.