feat: full Markdown support in service card comments (mistune)

app/main.py

@@ -16,6 +16,7 @@ from typing import Optional
 
 import docker
 import requests
+import mistune
 from fastapi import Depends, FastAPI, File, Form, HTTPException, Query, Request, UploadFile, status
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
@@ -299,34 +300,16 @@ def normalize_web_target(url: str) -> str:
     return f"http://{raw}"
 
 
+_md = mistune.create_markdown(
+    escape=True,
+    plugins=["strikethrough", "table", "task_lists"],
+)
+
 def format_service_comment(raw_text: str) -> Markup:
     raw = (raw_text or "").replace("\r\n", "\n").replace("\r", "\n").strip()
     if not raw:
         return Markup("")
-    escaped = str(escape(raw))
-    # Support pasted/plain markdown-like bold fragments.
-    escaped = re.sub(r"\*\*(.+?)\*\*", r"<strong>\1</strong>", escaped, flags=re.DOTALL)
-    # Allow a small safe subset of pasted HTML tags.
-    replacements = {
-        "&lt;b&gt;": "<b>",
-        "&lt;/b&gt;": "</b>",
-        "&lt;strong&gt;": "<strong>",
-        "&lt;/strong&gt;": "</strong>",
-        "&lt;i&gt;": "<i>",
-        "&lt;/i&gt;": "</i>",
-        "&lt;em&gt;": "<em>",
-        "&lt;/em&gt;": "</em>",
-        "&lt;u&gt;": "<u>",
-        "&lt;/u&gt;": "</u>",
-        "&lt;br&gt;": "<br>",
-        "&lt;br/&gt;": "<br>",
-        "&lt;br /&gt;": "<br>",
-    }
-    for src, dst in replacements.items():
-        escaped = escaped.replace(src, dst)
-    escaped = escaped.replace("\n", "<br>")
-    return Markup(escaped)
-
+    return Markup(_md(raw))
 
 def parse_rdp_target(target: str) -> dict:
     raw = (target or "").strip()