fix(english): address review findings in We Tried TLS plugin

[RevDev909]

Follow-up to #2588 (merged with the pre-fix version). Addresses the review-bot findings on plugins/english/wetriedtls.ts:

• Chapter HTML is now sanitized before it reaches the reader: script/iframe/object-style elements are removed, event-handler attributes (e.g. onerror) are stripped, and javascript: URLs are neutralized. All other markup is preserved.
• Image-only chapters (illustrations with no text) are now treated as real content instead of 'empty'.
• A failed chapter-list page can no longer silently truncate the list: a blank response throws, so parseNovel fails loudly instead of returning an incomplete list as though it were complete.
• Covers now use the site's direct CDN URL. A single URL field can't carry a fallback, so the images.weserv.nl proxy dependency is gone (in-chapter illustration shrinking is unchanged).

No test files added, per your note on #2575.

[greptile-apps]

Confidence Score: 0/5

[Medium risk] Adds a new novel-scraping plugin for a third-party site.

The PR does not appear safe to merge until the executable-link bypass and silent chapter-data loss paths are fixed.

Findings

1.   Encoded script links survive ▶
2.  Malformed pages truncate chapters ▶
3.  Unmatched chapter content disappears ▶
4.  Bold chapter lines disappear ▶

Summary

This PR adds the We Tried TLS plugin and its icon, with chapter extraction, catalog and status filtering, pagination, direct cover URLs, and chapter-HTML sanitization. The review found an encoded-URL sanitizer bypass and three ways chapter content or chapter lists can be silently lost.

_{Reviews (1) · Last reviewed commit: "Address review findings: sanitize chapte..."}

[greptile-apps]

Encoded script links survive If chapter HTML contains a link such as <a href="java&#115;cript:alert(1)">, this check leaves it intact because it tests the encoded text. The reader renders the returned HTML directly, so clicking the link can execute script. How this was verified: The URL check preserves the encoded attribute, and the reader inserts the returned chapter HTML with dangerouslySetInnerHTML.

[greptile-apps]

Malformed pages truncate chapters If a later free-chapter request returns a nonblank error page or malformed JSON, it passes the blank-response check. This parser then returns no chapters and defaults lastPage to 1, so parseNovel stops fetching pages and presents an incomplete chapter list as though it were complete.

[greptile-apps]

Unmatched chapter content disappears If a chapter mixes paragraphs with a list, table, or text in another unsupported container, body.match() keeps only the recognized blocks. For example, <p>Introduction</p><ul><li>Important note</li></ul> loses the note, so the reader displays an incomplete chapter.

[greptile-apps]

Bold chapter lines disappear If a chapter starts or ends with a genuine paragraph made entirely of bold text, this check treats it as a repeated title and removes it. That drops real content from the reader; if it was the only block, the chapter is reported empty.

[RevDev909]

Addressed the new review findings:

• The sanitizer now entity-decodes attribute values before the scheme check, so javascript:, j…, javascript:, and whitespace-smuggled variants are all neutralized (plus vbscript:).
• parseChapterList now throws on any malformed non-blank response (error pages, wrong JSON shape), not just blank ones — a bad page can no longer silently truncate the chapter list.
• Block extraction now keeps text-carrying containers it doesn't explicitly recognize (lists, tables, divs, blockquotes) instead of dropping them.
• A bold-only paragraph is only treated as the site's repeated title header when it matches the novel/chapter title (recorded from the chapter list and passed into the chapter parser); genuine bold content lines are kept, and translator/editor credit lines are stripped as site chrome.
  No test files added, per your note on feat(english): add Nightjar Reads source plugin #2575.

[RevDev909]

Superseded by #2604 — recreated off current master to resolve the add/add conflict (this branch predates the squash-merge of #2588). Same fixes, clean diff.