feat(pwa): rendered Markdown view toggle (closes #23)

[syswave-dev]

Summary

• Adds a Raw | Rendered segmented toggle in the result header so users can view the fetched output as formatted HTML alongside the existing raw source.
• Raw view remains the default. Selection persists in localStorage under pullmd-view-mode.
• GFM-standard rendering (headings, lists, links, images, tables, blockquotes, code blocks, strikethrough) via self-hosted marked v12.0.2.
• HTML sanitization via self-hosted DOMPurify v3.4.2. Strips scripts, inline styles, event handlers, javascript: URLs.
• Lazy first-render: the rendered DOM is only built when the user first switches to Rendered for a given result, so users who only ever copy raw Markdown pay no extra cost.
• Rendered links open in a new tab with rel="noopener noreferrer".
• Both themes (dark + paper) styled via existing CSS variables — no new tokens.
• Copy button still copies the raw Markdown source regardless of the active view.
• Service Worker (public/sw.js) precaches the new vendor files so the rendered view works offline in the installed PWA. CACHE_NAME bumped to pullmd-v20.

Closes #23. Bumps package.json to 2.4.0.

Out of scope (deferred)

• Syntax highlighting for code blocks
• Math / Mermaid / Reddit-style spoilers
• Side-by-side Raw + Rendered view
• Rendered view for /s/:id share links (still returns pure text/markdown)

Test plan

• Toggle click swaps view (Raw ↔ Rendered)
• Second toggle is instant (no re-render)
• New fetch while Rendered is active shows fresh content in Rendered view
• localStorage persistence: reload page, last mode restored
• Copy button copies raw Markdown regardless of active view
• Both themes (dark + paper) produce legible rendered output
• XSS resistance: <script>, <img onerror>, [link](javascript:) payloads neutralized
• All rendered links open in new tab with rel="noopener noreferrer"
• PWA offline: rendered view works on cached results
• node --test still passes (no server-side changes; 558/558 locally)

🤖 Generated with Claude Code