fix(parser, security): address remaining adversarial audit findings for single-quote data-line, nesting fast-path, and emoji tags (H-3, M-1, M-2, L-1)

[phine-apps]

Summary

Addresses remaining findings (H-3, M-1, M-2, L-1) from the adversarial code audit:

• H-3: Single-quoted data-line attribute support (src/markdown/structuralDiff.ts)
  • Updated replaceLineAttributesWithTokens, maskBlockAttributes, createToken, and stripDataLineAttributes to accept both double and single quotes (data-line='...').
  • Ensures Quick Edit offsets and line tracking remain synchronized when external renderers or plugins use single-quoted attributes.
• M-1: Fast-path $O(N)$ linear check for flattenDiffNesting (src/markdown/structuralDiff.ts)
  • Added hasDiffNesting(html) linear depth-tracking scanner.
  • Skips the nested lookahead regex entirely on documents that do not contain nested <del>/<ins> tags, eliminating $O(N \times M)$ overhead on large, flat diff blocks while strictly preserving identical output on complex nested structures.
• M-2: Robust tag stripping in verifyDiffIntegrity (src/markdown/domUtils.ts, src/markdown/structuralDiff.ts)
  • Extended stripHtmlTags(input, replacement = "") with an optional replacement string parameter.
  • Updated verifyDiffIntegrity to use iterative quote-aware stripHtmlTags(html, " ") instead of a single-pass regex, preventing bypasses from nested tags or attribute values containing >.
• L-1: Obsidian emoji tag support (src/markdown/obsidianPlugin.ts)
  • Extended Obsidian tag regex to support \p{Extended_Pictographic}, allowing tags starting with or containing Unicode emojis (e.g. #🚀, #🚀launch, #project/🔥/task).
  • Added unit tests in src/test/unit/obsidianPlugin.test.ts.

Verification

• pnpm run compile passed.
• pnpm run lint passed.
• pnpm run test:unit passed (279 passing tests).
• Verified $O(N)$ algorithmic complexity across all changes.