Harden the streaming code-block guard and narrow provider serialization

[gary149]

What

Two small hardening follow-ups from an external security review of the perf series (#2409 to #2415). Neither is an exploitable issue today; both remove implicit contracts that current safety silently depends on.

1. Streaming code-block guard now enforces the highlighter's output alphabet directly. The guard introduced in Lazy-load KaTeX/highlight.js and cut per-token markdown costs #2411 skipped DOMPurify on open fences when the html contained only span tags, but its regex allowed arbitrary attributes on those spans (<span onclick=...> would have passed). That was safe only via the implicit contract that highlightCode() never emits attributes. The guard now lives in markedLight.ts as isTrustedHighlighterHtml() and accepts exactly </span>, <span>, or <span class="..."> (double quotes, single space, no other attributes); anything else falls through to a full DOMPurify pass. Covered by unit tests including the attribute-injection cases.

2. Per-model providers serialization narrowed to the one field clients read. serializeModelDetail passed the upstream router's provider objects through verbatim. On HuggingChat that content is public metadata, but for self-hosted deployments with a custom router it would forward arbitrary upstream fields across an unauthenticated API boundary. The endpoint now maps providers down to { provider: string }, which is the only field the settings page uses, and the GETModelResponse type is tightened to match.

Verification

• New markedLight.spec.ts covering accepted hljs markup (including nested spans) and rejected payloads (onclick spans, single-quoted class, extra attributes, script/img/style tags, malformed closing tags)
• svelte-check, lint, and the utils test suites green (271 tests)

Independent of #2416 (disjoint files); the two merge in either order.