Descriptions are inline markdown; Feature.link withdrawn

Alternative and feature descriptions render links, emphasis and code
(pulldown-cmark, html feature only). Block structure flattens to one
paragraph, raw HTML is dropped, link targets are limited to https,
mailto and site-relative paths. A link belongs in the prose, so the
title-link field shipped in 0.3.7 goes before anyone uses it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/content.rs

@@ -136,6 +136,39 @@ impl Question {
     }
 }
 
+/// Descriptions are inline markdown: `[text](https://…)` links,
+/// `*emphasis*`, `**strong**`, `` `code` ``. Block structure is
+/// flattened (a description is one paragraph) and raw HTML in the
+/// source is dropped, so content can link out without being able to
+/// inject markup. Link targets are limited to https, mailto and
+/// site-relative paths; anything else renders as plain text.
+pub fn render_inline_markdown(text: &str) -> String {
+    use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
+    let parser = Parser::new_ext(text, Options::empty());
+    let mut in_link = 0usize;
+    let filtered = parser.filter_map(|event| match event {
+        Event::Html(_) | Event::InlineHtml(_) => None,
+        Event::Start(Tag::Paragraph) | Event::End(TagEnd::Paragraph) => None,
+        Event::SoftBreak => Some(Event::Text(" ".into())),
+        Event::Start(Tag::Link { dest_url, .. })
+            if !(dest_url.starts_with("https://")
+                || dest_url.starts_with("mailto:")
+                || dest_url.starts_with('/')) =>
+        {
+            in_link += 1;
+            None
+        }
+        Event::End(TagEnd::Link) if in_link > 0 => {
+            in_link -= 1;
+            None
+        }
+        other => Some(other),
+    });
+    let mut out = String::new();
+    html::push_html(&mut out, filtered);
+    out.trim().to_string()
+}
+
 /// Directory-scoped defaults: a `_section.yaml` file applies to every
 /// question at or below its directory (nearest ancestor wins per
 /// field, and a question's own declaration always overrides). This is
@@ -237,11 +270,6 @@ pub struct Feature {
     /// rendered via Iconify's public SVG API - no icon library bundled.
     #[serde(default)]
     pub icon: Option<String>,
-    /// An https URL the card's name links to - an announcement's
-    /// programme page, a venue. Plain-text descriptions can't carry
-    /// links, so this is the one place a card points elsewhere.
-    #[serde(default)]
-    pub link: Option<String>,
     #[serde(default)]
     pub requirements: Vec<Requirement>,
     /// Live data this feature pulls in. Read-only unless `transitions`
@@ -1022,16 +1050,6 @@ pub fn validate_questions(
             }
         }
         for alternative in &question.alternatives {
-            for feature in &alternative.features {
-                if let Some(link) = &feature.link {
-                    if !link.starts_with("https://") {
-                        anyhow::bail!(
-                            "question {:?} feature {:?}: link {:?} must be an https:// URL",
-                            question.id, feature.name, link
-                        );
-                    }
-                }
-            }
             // A dangling action is a literal dead end: the submit
             // button navigates to "Nothing here".
             if let Some(action) = &alternative.action {
@@ -1912,4 +1930,24 @@ alternatives:
         assert!(bucket_is_read(&qs, "things"));
         assert!(!bucket_is_read(&qs, EVENTS_BUCKET));
     }
+
+    // ── inline markdown ──────────────────────────────────────────────────
+
+    #[test]
+    fn markdown_links_and_emphasis() {
+        assert_eq!(
+            render_inline_markdown("See [the programme](https://attac.no/x) *soon*."),
+            "See <a href=\"https://attac.no/x\">the programme</a> <em>soon</em>."
+        );
+        assert_eq!(render_inline_markdown("plain text"), "plain text");
+        assert_eq!(render_inline_markdown("a\nb"), "a b");
+    }
+
+    #[test]
+    fn markdown_drops_html_and_unsafe_links() {
+        assert_eq!(render_inline_markdown("x <script>y</script> z"), "x y z");
+        assert_eq!(render_inline_markdown("[bad](javascript:alert(1))"), "bad");
+        assert_eq!(render_inline_markdown("[ok](/shape)"), "<a href=\"/shape\">ok</a>");
+        assert_eq!(render_inline_markdown("[mail](mailto:bl@uhhm.no)"), "<a href=\"mailto:bl@uhhm.no\">mail</a>");
+    }
 }