Support safe Mermaid rendering in Markdown views

**Motivation**

Architecture documentation commonly uses fenced Mermaid blocks. Buzz currently renders these as ordinary code blocks, so projects must commit both the Mermaid source and a generated SVG/PNG to make diagrams viewable.

**Proposed solution**

Render fenced `mermaid` code blocks client-side while keeping the Markdown source canonical.

Before implementation, I would like maintainer guidance on the initial scope:

1. Repository README and Markdown file views
2. Desktop messages
3. Canvas support as a later follow-up

The implementation would:

- lazy-load the renderer only when needed
- use strict security settings
- limit diagram input size
- avoid executing raw SVG/HTML
- fall back to the original code block on invalid input
- require no relay, database, API, or event-format changes

**Alternatives considered**

- Commit both `.mmd` and generated `.svg` files
- Use an external diagram service
- Render diagrams server-side

Committing generated images works but duplicates artifacts. External and server-side rendering add unnecessary infrastructure and reduce offline usability.

**Additional context**

Duplicate search found no open or closed issue/PR mentioning Mermaid.

Related but not duplicates:

- #2809 — structured interactive canvases and possible diagram dependencies
- #2960 — proposed future native desktop renderer
- #3459 — rich Markdown and fenced code blocks in developer mode

The issue names no files, tests, or entry points. First get maintainer guidance on whether the initial scope is repository README and Markdown views only, then identify the existing Markdown rendering path and its client-side boundaries; done means safe Mermaid rendering with lazy loading, strict security, size limits, invalid-input fallback, and no API or event-format changes.

Written by the indexing model from the issue text.