[BF-023] 重型依赖按需加载和 route-level code splitting

[baixiangcpp]

Issue

Closes #43

Scope

• Keep BF-023 scoped to heavy dependency isolation and route-level bundle guardrails.
• Remove isomorphic-dompurify from runtime dependencies so jsdom/cssstyle do not enter production analysis/prerender chunks.
• Split Markdown rehype sanitize schema out of the shared DOMPurify sanitizer so SVG/HTML sanitizer consumers do not import Markdown renderer-only dependencies.

Implementation

• Swapped the shared sanitizer from isomorphic-dompurify to direct dompurify.
• Added src/core/security/markdown-sanitize-schema.ts and updated the Markdown preview renderer to import the schema from that renderer-only module.
• Extended check:bundle-boundaries to block runtime imports of isomorphic-dompurify and jsdom, and keep DOMPurify isolated to the shared sanitizer.
• Updated the HTML injection surface guard to verify the sanitizer no longer imports isomorphic-dompurify or rehype-sanitize.

Acceptance Criteria

• 首页初始 bundle 不包含 Monaco。
• All Tools 初始 bundle 不包含图像/PDF heavy libs。
• Markdown Preview 才加载 Markdown/Monaco 相关模块。
• Image tools 才加载图像处理模块。
• npm run check:bundle-boundaries 通过。
• npm run build 通过。

Validation

• npm run lint - passed.
• npm run test - passed, 217 files / 1088 tests.
• npm run validate - passed.
• npm run build - passed, 1289 static pages.
• npm run test:e2e:smoke - passed.
• npm run analyze - passed; analyzer reports generated at .next/analyze/client.html, .next/analyze/nodejs.html, .next/analyze/edge.html. Existing analyzer warnings for server chunks 5980.js/55.js remain non-blocking.
• npm run check:bundle-boundaries - passed.

Bundle Evidence

• out/index.html: 8 initial scripts, heavy dependency hits: none.
• out/en.html: 16 initial scripts, heavy dependency hits: none.
• out/en/all-tools.html: 17 initial scripts, heavy dependency hits: none.
• Checked terms: monaco-editor, @monaco-editor, react-markdown, pdf-lib, qrcode, isomorphic-dompurify, jsdom, cssstyle, browser/default-stylesheet.
• npm run analyze no longer fails while prerendering /en/svg-optimizer; reports generated successfully.

Manual Checks

• Verified BF-023 issue [BF-023] 重型依赖按需加载和 route-level code splitting #43 is open before opening this PR.
• Reviewed diff for external requests, analytics, storage, and console logging changes.
• Confirmed PR only changes dependency isolation, sanitizer module boundaries, and bundle guard tests.

Privacy Check

• 不采集工具输入
• 不采集工具输出
• 不新增未披露的外部请求
• 不持久化敏感 payload

Screenshots / Evidence

• No UI surface changed; this is a bundle/dependency boundary PR.

[cloudflare-workers-and-pages]

Deploying byteflow with    Cloudflare Pages

Latest commit:	ea1070a
Status:	✅  Deploy successful!
Preview URL:	https://980010d3.byteflow-c58.pages.dev
Branch Preview URL:	https://perf-bf-023-heavy-deps-code.byteflow-c58.pages.dev

View logs