Products: images need https addresses; lowering a rating waits for review; library shows creators

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/src/html.ts

@@ -41,8 +41,8 @@ const options: sanitize.IOptions = {
       attribs: { ...attribs, rel: "nofollow ugc noopener noreferrer", target: "_blank" },
     }),
   },
-  // Images whose address was refused are dropped.
-  exclusiveFilter: (frame) => frame.tag === "img" && !frame.attribs.src,
+  // Images need an absolute https address (scheme rules don't apply to relative ones); others are dropped.
+  exclusiveFilter: (frame) => frame.tag === "img" && !/^https:\/\//i.test(frame.attribs.src ?? ""),
   disallowedTagsMode: "discard",
 };