test(quick-260329-ton): add failing tests for renderInlineMarkdown

- Tests cover plain text, empty string, italic, bold, mixed
- Tests cover XSS escaping and standalone asterisks

src/utils/markdown.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { renderInlineMarkdown } from "./markdown";
+
+describe("renderInlineMarkdown", () => {
+	it("returns plain text unchanged", () => {
+		expect(renderInlineMarkdown("hello")).toBe("hello");
+	});
+
+	it("returns empty string unchanged", () => {
+		expect(renderInlineMarkdown("")).toBe("");
+	});
+
+	it("converts single asterisks to <em>", () => {
+		expect(renderInlineMarkdown("press *f*")).toBe("press <em>f</em>");
+	});
+
+	it("converts double asterisks to <strong>", () => {
+		expect(renderInlineMarkdown("very **important**")).toBe(
+			"very <strong>important</strong>",
+		);
+	});
+
+	it("handles both bold and italic in one string", () => {
+		expect(renderInlineMarkdown("**bold** and *italic*")).toBe(
+			"<strong>bold</strong> and <em>italic</em>",
+		);
+	});
+
+	it("escapes HTML special characters before markdown processing (XSS safe)", () => {
+		expect(renderInlineMarkdown('<script>alert(1)</script>')).toBe(
+			"&lt;script&gt;alert(1)&lt;/script&gt;",
+		);
+	});
+
+	it("does NOT wrap standalone asterisks surrounded by spaces", () => {
+		expect(renderInlineMarkdown("2 * 3 * 4")).toBe("2 * 3 * 4");
+	});
+});