refactor(extract-text): rename stripHtml → extractText and document non-sanitiser status

Adds a module docstring at the top of extractText.ts spelling out that this
is text extraction, not XSS sanitisation, and that callers must rely on
safeHtml() (DOMPurify) for security. Adds a Vitest test block with classic
XSS-shaped payloads (<script>, <svg/onload>, <iframe srcdoc>, javascript:
href) asserting that no markup is re-emitted, even though the module is
explicitly not a sanitiser.

Updates the two callers (/geschichten index, GeschichtenCard) to import
from the new path. The collapse-whitespace pass also makes the regex
fallback's output saner for excerpt rendering.

Closes Nora's review B1 on PR #382.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/lib/components/GeschichtenCard.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
 import { m } from '$lib/paraglide/messages.js';
 import type { components } from '$lib/generated/api';
-import { plainExcerpt } from '$lib/utils/stripHtml';
+import { plainExcerpt } from '$lib/utils/extractText';
 import { formatDate } from '$lib/utils/date';
 
 type Geschichte = components['schemas']['Geschichte'];