feat: add raw HTML math rendering plugin to Streamdown

[chenyme]

Summary

Fix LaTeX formulas appearing as raw source inside visual HTML/card layouts.

Math inside raw HTML was not processed by remark-math because raw HTML is parsed later in the rendering pipeline. Add a focused rehype preprocessor that converts $...$ and $$...$$ within raw HTML text into KaTeX-compatible nodes before rehype-raw runs.

Code, preformatted content, scripts, styles, and textareas are excluded. Generated nodes continue through the existing HTML sanitization pipeline.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd frontend && pnpm lint
• cd frontend && pnpm exec tsc --noEmit
• git diff --check
• Rendered the reported HTML/LaTeX examples through Streamdown and KaTeX and confirmed that \mathbb, \frac, \nabla, and (P,Q) produce KaTeX output without raw dollar-delimited source.
• Build was not run because this is a focused frontend rendering fix.

Screenshots, API examples, or logs

Verified with the reported patterns:

<div>
  <ul>
    <li>适用范围：$\mathbb{R}^2$</li>
    <li>核心对象：$(P,Q)$</li>
    <li>联系量：$\frac{\partial Q}{\partial x}-\frac{\partial P}{\partial y}$</li>
    <li>联系量：$\nabla\times\mathbf{F}$</li>
  </ul>
</div>

All formulas are rendered by KaTeX instead of being displayed as raw LaTeX.

Configuration, migration, and compatibility notes

No configuration, API, database, deployment, or migration changes.

Existing raw HTML sanitization remains enabled. The new preprocessing step only creates language-math nodes already supported by the current KaTeX renderer.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Raw HTML and generated math nodes continue through the existing sanitization and hardening pipeline.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.