Require SECRET_KEY, prevent open redirects, validate image uploads, and sanitize post content

[DaaanielTV]

Motivation

• Enforce stronger security by requiring SECRET_KEY to be set and preventing open redirect attacks on login flow.
• Harden file uploads by validating and verifying featured images and ensuring uploads directory exists.
• Prevent XSS by rendering Markdown to HTML and sanitizing output before display.

Description

• create_app() now raises an error if SECRET_KEY is not provided and ensures the UPLOAD_FOLDER exists by creating it with Path(...).mkdir(...).
• Authentication changes add a safe redirect check using urlparse/urljoin to avoid open redirects and remove automatic first-user admin promotion during registration.
• Admin image handling now validates extensions, verifies image files with Pillow, generates UUID-based unique filenames, and centralizes image saving in _save_featured_image with a whitelist of allowed extensions.
• Post model gains a rendered_content property that converts Markdown to HTML using markdown and sanitizes it with bleach (explicit allowed tags and attributes), and templates use post.rendered_content instead of raw content.
• Updated requirements.txt to include bleach and ensured Pillow is present; added necessary imports and minor cleanup across modules.

Testing

• Ran python -m pytest which collected no tests (no automated tests present in the repository).
• Executed a basic application startup smoke test with python -c "from app import create_app; create_app()", which succeeded without raising errors.

---

Codex Task