Dedupe MarkdownFormatter into a shared package

[MaxGhenis]

Context

The repo currently maintains two near-duplicate copies of MarkdownFormatter.tsx:

• app/src/components/blog/MarkdownFormatter.tsx (Vite / legacy)
• website/src/components/blog/MarkdownFormatter.tsx (Next.js)

Several recent bugs existed only in one copy:

• useEffect deps reference ref.current?.cellIndex; refs are not reactive #981 — stale useEffect dependencies (app/ only)
• HighlightedBlock drops right pane when &&& separator missing #982 — HighlightedBlock parts[1] crash (both, fixed in the bug-audit batch)
• MarkdownFormatter uses as any casts that hide react-markdown prop-shape bugs #988 — unsafe as any type assertions (app/ only)
• Anchor renderer in MarkdownFormatter does not run href through isSafeHref #989 — <a> href not routed through isSafeHref (app/ only)

A drift check (scripts/check-markdown-drift.ts) was added in the bug-audit batch to catch top-level API divergence, but the real fix is to extract the shared component into a package consumed by both sub-apps.

Plan

1. Create a new workspace package (e.g. packages/blog) exporting MarkdownFormatter, HighlightedBlock, PlotlyChartCode, blog styles, useDisplayCategory, LazyPlot.
2. Factor out sub-app-specific dependencies (e.g. OptimisedImage in app/) via a small props/context surface so the shared component is framework-agnostic.
3. Replace both app/src/components/blog/MarkdownFormatter.tsx and website/src/components/blog/MarkdownFormatter.tsx with re-exports from the shared package.
4. Delete scripts/check-markdown-drift.ts and its PR check once dedup is complete.

Notes

• Keep the "use client" pragma in the website adapter (Next.js RSC requirement).
• safeHref helper (from Anchor renderer in MarkdownFormatter does not run href through isSafeHref #989) should live alongside the shared component.