feat(cmsblock): first iteration of composable CMS block editor and Express service

[digitalrisedorset]

Summary

Introduce the first working CMSBlock vertical slice in ReactEdge: author HTML/text, choose editorial style and image placement independently, generate responsive HTML/CSS, review it, and approve or reject revisions. Approved content remains unchanged while newer drafts are prepared.

Included

• Portable widget with Edit / Review / View modes, three editorial styles (Editorial, Minimal, Promotional), three image layouts (above, left, right), image-reference previews, and sandboxed preview rendering.
• Express/TypeScript CMSBlock service to handle the cms data cycle
• Existing single-block API under /cmsblock/blocks/demo: GET, PUT, POST /generate, /approve, and /reject; JSON storage and stable published revisions; deterministic (non-AI) generation.

Scope and limitations

• This is a development-only proof of concept, not a production CMS.
• Hard-coded block ID demo, filesystem-backed demo.json, and deterministic image/style composition rather than a multimodal AI generator.
• Service binds to loopback by default; no authentication, authorization, or rate limiting. Do not expose the API publicly. CORS is not access control.
• Source HTML is converted to escaped text and up to three HTTPS image URLs. Public SSR rendering of generated HTML/CSS would require additional validation and sanitisation.
• The branch is currently behind main by two commits; review/reconcile before merging.

Review checklist

• Run widget against new Express service locally (save → generate → review → approve → reload).
• Confirm npm --prefix widgets/cmsblock run build and browser tests.
• Review auth/security boundaries and keep the service private.
• Confirm deployment expectations before enabling server-side publication.

Follow-up (out of scope)

Multi-block IDs, authenticated editorial access, production publishing, real image-understanding AI, and stronger integration/observability verification.