Fix regex HTML sanitization in extract-url.ts (19 CodeQL alerts)

[bmmoskow]

CodeQL reports 19 open alerts, almost all in supabase/functions/gemini-translate/extract-url.ts:

• 15× js/incomplete-multi-character-sanitization
• 4× js/bad-tag-filter

Root cause is the same: HTML is being stripped/sanitized with regex, which CodeQL flags as unreliable. Because it's one clustered pattern, the fix is likely a few real edits rather than 19 separate ones.

Handling

• Replace regex-based HTML stripping with a real HTML parser. @mozilla/readability and htmlparser2 are already available.
• For any genuine false positives, dismiss with a reason in the Security tab rather than editing code.

Where to see them

GitHub repo → Security tab → Code scanning, filter by tool = CodeQL.