ElyMark: the page hands every link click to the app (M-05)

Preview clicks and Cmd/Ctrl clicks in the editor go through one
click handler; it stops the browser and sends the link mark's own
address, since Milkdown blanks unsafe hrefs in the DOM. Reviews run
at effort xhigh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/BUGS.md

@@ -65,7 +65,7 @@
 - [x] M-02 `refresh` 归零版本计数却不换代，在途的一键让标签一直“未落定” — 刷新即换代、归零并结束欠下的渲染（tally.rs）；R1 渲染回调悬空、无在途消息的测试；R2 测试未证旧代归零；R3 PASS
 - [x] M-03 干净标签接过磁盘文字后关闭仍问“是否保存” — 接过磁盘文字的各路（同文、干净重载、合并）都经 adopt_disk，标签与视图的保存基线同设；R1 合并采用未同步视图基线；R2 注释超长；R3 PASS
 - [x] M-04 第二次打印或导出 PDF 悄悄取消第一次，没有文件也没有错误 — 每份打印与导出各有编号与文件，作业按编号保留、互不取消；每份作业完成时记下编号与结果；R1 窗口测试只数日志；R2 PASS（窗口测试只在 macOS，本机未运行）
-- [ ] M-05 点页面里的链接什么也不发生
+- [x] M-05 点页面里的链接什么也不发生 — 页面拦下链接单击，地址取链接标记原文，预览单击、可视 Cmd/Ctrl 单击交应用（审查 4 轮）
 - [ ] M-06 `on_app_quit` 无条件删恢复点与崩溃锁，AppKit 直接终止时丢未保存内容
 - [ ] M-07 崩溃恢复的未命名副本按“第一个显示的未命名标签”配对，内容可能落错标签
 - [ ] M-08 页面重载后悬着的渲染回调永不完成，导出既不成功也不报错

tasks/reviews/M-05-r1.md

@@ -0,0 +1,3 @@
+FAIL
+
+- apps/ely-mark/src/view.rs:270: The fix handles only `Event::Leave`, but visual-mode links never produce it. Open `[web](https://example.com/)` or `[mail](mailto:test@example.com)` in visual mode and click the link: Chromium treats the anchor as editable text, so no navigation reaches `Requests::on_before_browse` and neither the browser nor mail client opens. Disallowed links likewise produce no refusal. A WSL probe built the current bundled page and used real Playwright clicks: HTTPS, mailto and FTP each produced zero `Page.frameRequestedNavigation` events in visual mode; all three produced `anchorClick` events in preview. Ctrl-click on the visual HTTPS link also produced no navigation. Handle explicit link activation in the visual editor and forward it through the host's allowed/refused link policy. Add regression coverage that clicks rendered links in both modes and verifies opening/refusal; the current Cargo suites contain no M-05 test and pass on WSL despite this failure.

tasks/reviews/M-05-r2.md

@@ -0,0 +1,5 @@
+FAIL
+
+- apps/ely-mark/web/src/visual.js:82: Link activation uses the marks at a rounded caret position instead of the clicked anchor. Real Playwright clicks against freshly built pages reproduce this on native Windows and WSL: in `Go [website](https://example.com/) now.`, Ctrl-click 1 px inside the link's left edge sends no `link` query; in `[one](https://one.example/)[two](https://two.example/)`, the same click inside `two` sends `https://one.example/`. Clicking just after `website` also activates that link. Resolve the actual clicked anchor, including its descendants, rather than the insertion-position marks. Add regression clicks at both edges and between adjacent links; the current center-click test passes despite these failures.
+
+- crates/ely-office/src/lib.rs:270: The allowed-scheme check is case-sensitive, while the new visual handler forwards the original Markdown address. For `[upper](HTTPS://example.com/)`, Ctrl-click sends `HTTPS://example.com/` and `MarkView::follow` emits the refusal message; preview click produces the normalized `https://example.com/` and opens outside. Both page paths were verified on Windows and WSL. HTTP, HTTPS and mailto schemes are case-insensitive, so these paths violate the required shared policy. Parse or normalize the scheme consistently before checking it, and test the host's allowed/refused outcome for mixed-case schemes as well as page event delivery.

tasks/reviews/M-05-r3.md

@@ -0,0 +1,3 @@
+FAIL
+
+- apps/ely-mark/web/src/visual.js:82: Plain preview clicks still bypass the required refusal policy when Milkdown sanitizes a link's scheme. Open `[local](file:///outside/file.md)` or `[data](data:text/plain,hello)` in preview and click it: the rendered anchor has `href=""`, so Chromium navigates to the bundled `index.html` instead of sending a link query. That URL passes `Surface::navigable`, so `Requests::on_before_browse` never queues `Event::Leave` and `MarkView::follow` never displays the refusal. Fresh-page Playwright probes reproduced the empty href, same-page navigation and zero link queries on native Windows and WSL; a WSL CEF off-screen probe also confirmed a user-initiated navigation to the bundled index. Intercept preview link activation before the browser default, apply the host policy to sanitized/empty addresses too, and add preview regression cases for these schemes; the current FTP-only refusal delivery coverage misses them.

tasks/reviews/M-05-r4.md

@@ -0,0 +1 @@
+PASS