Add Wave 1 block server schemas (page builder step 3, server half)

Register all seven Wave 1 block types with their server-side validation
schemas, self-registering via server/src/blocks/types/*:
heading, rich_text, image, two_column (container), cta, divider, quote.

- propHelpers.js: shared validators (isSafeUrl rejects javascript:/data:/
  protocol-relative, enum/required/optional text, strict key allowlist).
- rich_text carries a `sanitize` normalizer (registry now supports it) that
  runs html through the shared cleanBody allowlist on save.
- Registry entrypoint requires the type modules so all schemas load.

Verified: all 7 register; valid blocks pass; malformed props yield precise
per-path errors; one-level nesting cap enforced; rich_text sanitize strips
script/onerror.

Client renderers + editors (step 3 client half) still to come.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/blocks/registry.js

@@ -12,6 +12,9 @@
 //     version: 1,             // prop-schema version; bump when props change so a
 //                             // one-time migration can transform older blocks
 //     schema: (props) => [],  // returns an array of error strings ([] = valid)
+//     sanitize: (props) => props, // optional normalizer run on save AFTER
+//                             // validation, e.g. rich_text runs its html through
+//                             // the shared allowlist; returns cleaned props
 //     cacheTTL: null,         // seconds a rendered instance may be cached;
 //                             // null = never cache (static blocks). Dynamic
 //                             // Wave 2 blocks set this (e.g. server_status: 10).
@@ -47,6 +50,9 @@ function registerBlock(def) {
   if (def.schema != null && typeof def.schema !== 'function') {
     throw new Error(`registerBlock: ${def.type}.schema must be a function`)
   }
+  if (def.sanitize != null && typeof def.sanitize !== 'function') {
+    throw new Error(`registerBlock: ${def.type}.sanitize must be a function`)
+  }
   const containerSlots = def.containerSlots || []
   if (def.container && containerSlots.length === 0) {
     throw new Error(`registerBlock: container block ${def.type} needs containerSlots`)
@@ -55,6 +61,7 @@ function registerBlock(def) {
     type: def.type,
     version: Number.isInteger(def.version) ? def.version : 1,
     schema: def.schema || null,
+    sanitize: def.sanitize || null,
     cacheTTL: def.cacheTTL == null ? null : Number(def.cacheTTL),
     container: Boolean(def.container),
     containerSlots: Object.freeze([...containerSlots]),