Root cause: DOMPurify afterSanitizeAttributes hook was treating verstak://
links as blocked because hash-based href didnt match ALLOWED_SCHEMES regex.
Fix:
1. afterSanitizeAttributes hook now checks data-verstak-href first and
returns early for internal links - they never get blocked
2. Changed href from hash-based to about:blank (safe value that
DOMPurify wont strip, unlike javascript:void(0))
3. Click handler already uses data-verstak-href, not href
Added unit test: markdown.test.js (27 tests for renderer.link output)
mirivlad