Write notes as formatted text, store them as Markdown

The editor was a textarea holding raw Markdown, which is the wrong thing
to hand someone taking notes during a lesson: nobody types `##` and `**`
while a teacher is talking. It now shows the note formatted and puts a
toolbar above it — headings, bold, lists, tick boxes, quotes, links,
tables — while the file on disk stays exactly what it was, because that
is what the indexer reads and what outlives this app.

`markdown.js` is the whole translation: `markdownToHtml` on the way in,
`markdownFromDom` on the way out. The property that matters is that the
round trip settles — one pass may tidy a note, a second must change
nothing — because these notes are the only record of what was said in
the room and there is nothing to restore a lossy save from. `editor.js`
checks exactly that before opening a note formatted, and a note it
cannot hold unchanged opens in the Markdown view and says so instead of
being quietly reduced.

No editor library: the content security policy allows no outside script
and the app has no bundler, so this is `contenteditable` and
`execCommand` with a tolerant serializer behind it — an element it does
not model keeps its words and loses its tag. Pasted HTML is converted to
Markdown before it reaches the document, which is the one place where
sanitising and formatting are the same operation.

Tested against `test/mini-dom.ts`, sixty lines of read-only DOM, rather
than a headless browser or a DOM dependency; the toolbar itself was
driven by hand in Firefox. WebKit has still never run it.

scripts/smoke.mjs

@@ -726,10 +726,22 @@ console.log('\n== web app ==');
 	);
 	check('the shell holds no secret of its own', !shellText.includes(WEB_PASSWORD) && !shellText.includes(TOKEN));
 
-	const assets = await Promise.all(
-		['app.js', 'app.css', 'icon.svg', 'manifest.webmanifest'].map((name) => fetch(`${root}/app/${name}`)),
-	);
+	// Every file the shell asks for, including the two modules the editor is
+	// made of: a missing one leaves a page that loads and cannot type.
+	const assetNames = ['app.js', 'editor.js', 'markdown.js', 'app.css', 'icon.svg', 'manifest.webmanifest'];
+	const assets = await Promise.all(assetNames.map((name) => fetch(`${root}/app/${name}`)));
 	check('the app\'s assets are served', assets.every((response) => response.ok), assets.map((r) => r.status).join(' '));
+	check(
+		'the editor\'s modules are served as JavaScript',
+		assets
+			.filter((_, index) => assetNames[index].endsWith('.js'))
+			.every((response) => /javascript/.test(response.headers.get('content-type') ?? '')),
+		assets.map((r) => r.headers.get('content-type')).join(' | '),
+	);
+	check(
+		'the shell loads the app as a module, so its imports resolve',
+		/<script type="module" src="app\.js">/.test(shellText) && shellText.includes('data-command="bold"'),
+	);
 
 	const anonymousSession = await (await fetch(`${root}/app/session`)).json();
 	check('session says "not logged in" rather than failing', anonymousSession.authenticated === false);