Security+UX: Add DOMPurify XSS protection, security headers, admin auth gate, import file size limit, due date color coding, swipe/scroll conflict prevention

src/components/tasks/MarkdownNoteEditor.tsx

@@ -1,6 +1,7 @@
-"use client";
+"use client";
 import React, { useState, useRef, useCallback, useEffect } from "react";
 import { marked } from "marked";
+import DOMPurify from "dompurify";
 import { useI18n } from "@/lib/i18n";
 
 interface MarkdownNoteEditorProps {
@@ -114,7 +115,13 @@ export function MarkdownNoteEditor({ value, onChange, onSave }: MarkdownNoteEdit
         return `<span class="markdown-checkbox-box" data-idx="${id}"></span>`;
       });
 
-      return rawHtml;
+      // XSS 방어: DOMPurify sanitize (링크 target=_blank, class, data-idx 허용)
+      const sanitized = DOMPurify.sanitize(rawHtml, {
+        ADD_ATTR: ["target", "rel", "data-idx", "class"],
+        ALLOW_DATA_ATTR: true,
+      });
+
+      return sanitized;
     } catch {
       return value;
     }