fix(landing-page): render iframe embed codes instead of stripping them

The embed section passed code through SafeHtmlContent which ran DOMPurify
with FORBID_TAGS including 'iframe', silently removing the element.

Replaced SafeHtmlContent with a new sanitizeEmbedHtml() that uses a
whitelist of ALLOWED_TAGS: ['iframe'] and restricts src to https: only,
so Google Forms, YouTube, and other https embeds render while javascript:
sources and non-iframe tags are still blocked.

packages/ui/src/tools/sanitize.ts

@@ -133,6 +133,34 @@ export function splitHtmlAndSvg(html: string): ContentSegment[] {
   return segments;
 }
 
+/**
+ * Sanitizes an embed code snippet (e.g. a pasted <iframe>). Allows only
+ * <iframe> tags with https: sources; everything else is stripped. Use this
+ * for org landing-page embed sections — not for general rich-text content.
+ */
+export function sanitizeEmbedHtml(html: string): string {
+  if (typeof html !== 'string') return '';
+  if (!browser) return '';
+
+  return DOMPurify.sanitize(html, {
+    ALLOWED_TAGS: ['iframe'],
+    ALLOWED_ATTR: [
+      'src',
+      'width',
+      'height',
+      'frameborder',
+      'marginheight',
+      'marginwidth',
+      'title',
+      'loading',
+      'allow',
+      'allowfullscreen',
+      'sandbox'
+    ],
+    ALLOWED_URI_REGEXP: /^https:/i
+  });
+}
+
 /**
  * Strips all HTML tags and returns plain text
  * Use this when you only need the text content