Write notes as formatted text, store them as Markdown

The editor was a textarea holding raw Markdown, which is the wrong thing
to hand someone taking notes during a lesson: nobody types `##` and `**`
while a teacher is talking. It now shows the note formatted and puts a
toolbar above it — headings, bold, lists, tick boxes, quotes, links,
tables — while the file on disk stays exactly what it was, because that
is what the indexer reads and what outlives this app.

`markdown.js` is the whole translation: `markdownToHtml` on the way in,
`markdownFromDom` on the way out. The property that matters is that the
round trip settles — one pass may tidy a note, a second must change
nothing — because these notes are the only record of what was said in
the room and there is nothing to restore a lossy save from. `editor.js`
checks exactly that before opening a note formatted, and a note it
cannot hold unchanged opens in the Markdown view and says so instead of
being quietly reduced.

No editor library: the content security policy allows no outside script
and the app has no bundler, so this is `contenteditable` and
`execCommand` with a tolerant serializer behind it — an element it does
not model keeps its words and loses its tag. Pasted HTML is converted to
Markdown before it reaches the document, which is the one place where
sanitising and formatting are the same operation.

Tested against `test/mini-dom.ts`, sixty lines of read-only DOM, rather
than a headless browser or a DOM dependency; the toolbar itself was
driven by hand in Firefox. WebKit has still never run it.

docs/DEPLOY-NOTES.md

@@ -12,7 +12,7 @@ should not make twice**, because changing it later means moving files by hand.
 | | |
 |---|---|
 | **Your own lesson notes** | A directory of Markdown files the server reads, indexes and searches beside Schulcloud and WebUntis. Three tools: `list_notes`, `get_note`, `add_note`. |
-| **The app at `/app`** | A login, a day-at-a-time notes editor, and a settings page that replaces the Schulcloud token. Only served when `WEB_PASSWORD` is set. |
+| **The app at `/app`** | A login, a day-at-a-time notes editor with a formatting toolbar, and a settings page that replaces the Schulcloud token. Only served when `WEB_PASSWORD` is set. |
 | **The WebUntis class register** | `untis_lesson_topics` now takes a subject as well as a period id, and `UNTIS_HISTORY_DAYS` of "what was actually taught" goes into the search index. |
 
 Nothing here changes Schulcloud or WebUntis: both stay read-only. The notes
@@ -241,6 +241,8 @@ write them.
 | `Der Server nimmt keine Änderungen an` | `NOTES_READONLY` is on | Remove it and recreate the container |
 | Saves refused as a conflict, repeatedly | The note is being changed elsewhere — a sync tool, another device | Choose a version in the banner; if a sync tool keeps rewriting the file, it is fighting the app |
 | `EACCES` for `/data/notes` in the logs | A bind-mounted directory the container's user cannot write | `sudo chown -R 1000:1000 /home/pi/Notizen` (match the image's user), then recreate |
+| The toolbar is there, the text stays plain | The browser blocked `editor.js` or `markdown.js` | Check the console; both must be served from `/app/`, and `app.js` must load as `type="module"` |
+| A note opens in the Markdown view by itself, with a hint | It holds formatting the formatted view cannot keep unchanged | Nothing is wrong and nothing was lost; edit it there, or simplify the note |
 | Notes exist but `search` cannot find them | Only a full crawl reads them | `schulcloud refresh --force` |
 | `search` finds a day note but names no subject | The lesson headings were rewritten past recognition | Keep `## 1. Deutsch …`; the leading number and the subject are what the index reads |
 | `untis_lesson_topics` with a subject finds nothing | The subject code differs from what you typed | Check it against `untis_timetable`; the register uses the school's own codes |

docs/NOTES.md

@@ -87,6 +87,41 @@ thing I open in a free period".
   `add_note` — the save is refused and you are asked which version wins. It
   never silently overwrites.
 
+### Writing, without typing Markdown
+
+The editor shows the note **formatted** — headings as headings, bold as bold,
+tables as tables — and the toolbar above it writes the Markdown. Nobody types
+`##` or `**` during a lesson.
+
+| Button | What it writes |
+| --- | --- |
+| `H2` | a lesson heading — the one that makes the lesson separately searchable |
+| `H3` | a subheading inside a lesson |
+| `F` `K` `S` | **fett**, _kursiv_, ~~durchgestrichen~~ (`Strg`/`Cmd` + B, I) |
+| `<>` | inline code (`Strg`/`Cmd` + E) |
+| `• —` `1. —` | bullet and numbered lists; nest them with Tab |
+| `☐` | a box to tick off |
+| `❝` | a quote — the teacher's exact wording |
+| `🔗` `▦` | a link (`Strg`/`Cmd` + K) and a table |
+| `MD` | the Markdown itself |
+
+`Enter` starts a new paragraph, `Shift+Enter` a new line in the same one. A
+paste from a web page or a PDF keeps its structure and loses its fonts, colours
+and anything else that is not in the list above — pasted HTML is converted to
+Markdown before it reaches the page, which is what keeps a copied page from
+bringing its script along.
+
+**The file is still Markdown.** `MD` shows it and lets you edit it directly,
+which is the way to write something the toolbar has no button for. There is no
+underline, because Markdown cannot store one — `F` or `K` instead.
+
+Opening a note may tidy it once: `*so*` becomes `_so_`, a table typed unevenly
+lines up. Nothing is rewritten until you actually change something, and a note
+whose formatting the view cannot hold unchanged **opens as Markdown** and says
+so rather than being quietly reduced. `test/app-markdown.test.ts` is what holds
+that promise up: every construct in this document goes in and comes back out
+unchanged.
+
 **Einstellungen** holds the Schulcloud token: how long it has left, and the box
 to paste a fresh `jwt` cookie into when it expires (the same thing `schulcloud
 token set` and the older `/token` page do). It also shows the index's state and