refactor: vendor marked + dompurify 到项目内，实现零外部依赖

- marked (77行 ESM) + dompurify (1398行 ESM) 复制到 src/vendor/
- 包含 LICENSE 文件和类型声明（dompurify 类型去除 trusted-types 外部依赖）
- 移除 package.json 中 marked/dompurify/@types/dompurify 依赖
- 移除 electron-builder files 配置中的 node_modules 引用
- tsconfig.json include 新增 src/vendor/**/*.d.ts

src/renderer/utils/marked-config.ts

@@ -2,7 +2,7 @@
  * Markdown 渲染器配置 — 基于 marked 库
  */
 
-import { marked as markedLib, Renderer } from 'marked';
+import { marked as markedLib, Renderer } from '../../vendor/marked.js';
 import { sanitize } from './sanitizer.js';
 
 // 自定义渲染器：链接安全检查

src/renderer/utils/sanitizer.ts

@@ -2,7 +2,7 @@
  * Sanitizer — 基于 DOMPurify 的 HTML 净化器
  */
 
-import DOMPurify from 'dompurify';
+import DOMPurify from '../../vendor/dompurify.js';
 
 // 允许的 data URI 类型
 const SAFE_DATA_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml']);