Refactor flash message and remove SanitizeHTML template func

[wxiaoguang]

1. Fix the "flash message" layout problem for different cases
   • I am sure most of the users should have ever seen the ugly center-aligned error message with multiple lines.
2. Fix inconsistent "Details" flash message EOL handling, sometimes \n, sometimes <br>
   • Now, always use "\n" and use <pre> to render
3. Remove SanitizeHTML template func because it is not useful and can be easily abused.
   • But it is still kept for mail templates, for example: SafeHTML is not available anymore - no breaking change documented #36049
4. Clarify PostProcessCommitMessage's behavior and add FIXME comment

By the way: cleaned up some devtest pages, move embedded style block to CSS file

[wxiaoguang]

[Copilot]

Pull request overview

This PR refactors how flash messages are rendered across the web UI to improve layout consistency (single-line vs multi-line), standardize “details” rendering using \n + <pre>, and remove the SanitizeHTML template func from normal web templates to reduce misuse potential (while keeping compatibility for mail templates). It also adjusts commit-message post-processing APIs to make the HTML-in/HTML-out behavior explicit.

Changes:

• Centralize flash message rendering via ctx.RenderUtils.RenderFlashMessage, with improved alignment and newline handling.
• Replace SanitizeHTML usage in web templates/handlers with safer alternatives (markup.Sanitize, escaping helpers, or pre-rendered HTML).
• Update PostProcessCommitMessage to accept/return template.HTML, and update affected call sites.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
web_src/css/devtest.css	Moves devtest <h1>/<h2> styling into the CSS file and adds demo form styling.
web_src/css/base.css	Updates flash-message styling for <pre> and adds .flex-relaxed-list helper layout class.
templates/repo/issue/view_content/comments.tmpl	Switches commit-ref comment rendering to a dedicated sanitized HTML getter.
templates/repo/commit_page.tmpl	Removes SanitizeHTML from rendered git note content display.
templates/devtest/toast-and-message.tmpl	Wraps devtest content in a container for consistent layout.
templates/devtest/fetch-action.tmpl	Cleans up devtest markup, uses new layout helper class, and removes inline styles.
templates/devtest/devtest-header.tmpl	Wraps alerts in a container and passes ctx.RootData to alert partial.
templates/base/alert.tmpl	Refactors flash rendering to RenderFlashMessage and tweaks 2FA-required message markup/classes.
templates/base/alert_details.tmpl	Renders summary/details via <pre> and removes SanitizeHTML usage.
routers/web/repo/pull.go	Replaces <br>-based details concatenation with \n and switches to escaping helper.
routers/web/repo/issue_view.go	Replaces templates.SanitizeHTML usage with markup.Sanitize and removes unused import.
routers/web/repo/issue_new.go	Switches invalid-template flash “Details” to escaped \n-based content.
routers/web/repo/editor_error.go	Uses escaping helper and changes JSON fallback error response to a generic message; improves logging.
routers/web/repo/commit.go	Adapts to PostProcessCommitMessage HTML-in/HTML-out signature.
routers/web/repo/branch.go	Switches push-rejected details to escaping helper.
routers/web/feed/convert.go	Replaces templates.SanitizeHTML with markup.Sanitize for feed descriptions.
routers/web/devtest/devtest.go	Updates devtest flash messages to use \n and adds mock data for toast/message page.
routers/utils/utils.go	Replaces SanitizeFlashErrorString with EscapeFlashErrorString returning escaped template.HTML.
routers/utils/utils_test.go	Updates the test to call the renamed function (but expected values still reflect old behavior).
modules/templates/util_render.go	Updates commit-message rendering to match new post-processing API and adds RenderFlashMessage.
modules/templates/mail.go	Keeps SanitizeHTML available for mail templates (deprecated) by mapping to internal sanitizer.
modules/templates/helper.go	Removes SanitizeHTML from web func map; makes sanitizer helper unexported.
modules/templates/helper_test.go	Updates sanitizer test to use the unexported helper.
modules/markup/html.go	Changes PostProcessCommitMessage signature to template.HTML and adds clarifying FIXME.
models/issues/comment.go	Adds a new method to return sanitized HTML for commit-ref comment content.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bircni]

worth a back port?

[wxiaoguang]

worth a back port?

Nope. No backport for a non-bug PR