Foro (escritura): crear tema y responder, con saneado HTML

- lib/forum-sanitize.ts: cleanPostHtml con sanitize-html (misma allowlist que
  forum/sanitize.py de nh3: formato básico + a/img/tablas, rel nofollow, esquemas
  http/https/mailto). Verificado XSS-safe (script/onclick/javascript: eliminados).
- lib/forum-write.ts: createTopic (tema + primer post), createPost (respuesta +
  updated_at), forumIsPostable / topicIsReplyable.
- Routes /api/forum/topic y /api/forum/reply (guard de sesión; identidad = cuenta de
  juego: poster=username, poster_id=accountId). Componentes NewTopicForm y ReplyForm
  (clientes). Se muestran solo si hay sesión; el tema cerrado no admite respuesta.

Verificado: escritura 401 sin sesión, saneado correcto. Pendiente: editar/borrar,
moderación (fijar/cerrar/mover), búsqueda, editor enriquecido.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/app/[locale]/forum/[forumId]/page.tsx

@@ -2,6 +2,8 @@ import { notFound } from 'next/navigation'
 import { getTranslations, setRequestLocale } from 'next-intl/server'
 import { Link } from '@/i18n/navigation'
 import { getForum, getTopics } from '@/lib/forum'
+import { getSession } from '@/lib/session'
+import { NewTopicForm } from '@/components/NewTopicForm'
 
 export const dynamic = 'force-dynamic'
 
@@ -18,6 +20,8 @@ export default async function ForumPage({
   const forum = await getForum(id)
   if (!forum) notFound()
   const topics = await getTopics(id)
+  const session = await getSession()
+  const canPost = Boolean(session.username)
 
   return (
     <main className="mx-auto max-w-4xl px-4 py-8">
@@ -52,6 +56,12 @@ export default async function ForumPage({
           ))}
         </ul>
       )}
+
+      {canPost ? (
+        <NewTopicForm forumId={id} />
+      ) : (
+        <p className="mt-8 text-sm text-amber-200/60">{t('loginToPost')}</p>
+      )}
     </main>
   )
 }

web-next/app/[locale]/forum/topic/[topicId]/page.tsx

@@ -2,6 +2,8 @@ import { notFound } from 'next/navigation'
 import { getTranslations, setRequestLocale } from 'next-intl/server'
 import { Link } from '@/i18n/navigation'
 import { getTopic, getPosts } from '@/lib/forum'
+import { getSession } from '@/lib/session'
+import { ReplyForm } from '@/components/ReplyForm'
 
 export const dynamic = 'force-dynamic'
 
@@ -18,6 +20,8 @@ export default async function TopicPage({
   const topic = await getTopic(id)
   if (!topic) notFound()
   const posts = await getPosts(id)
+  const session = await getSession()
+  const canReply = Boolean(session.username) && !topic!.locked
 
   return (
     <main className="mx-auto max-w-4xl px-4 py-8">
@@ -47,6 +51,12 @@ export default async function TopicPage({
           </article>
         ))}
       </div>
+
+      {canReply ? (
+        <ReplyForm topicId={id} />
+      ) : (
+        !session.username && <p className="mt-6 text-sm text-amber-200/60">{t('loginToPost')}</p>
+      )}
     </main>
   )
 }

web-next/app/api/forum/reply/route.ts

@@ -0,0 +1,15 @@
+import { getSession } from '@/lib/session'
+import { createPost, topicIsReplyable } from '@/lib/forum-write'
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId || !session.username) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  let b: Record<string, string> = {}
+  try { b = await request.json() } catch { return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 }) }
+  const topicId = Number(b.topicId)
+  const text = String(b.text ?? '').trim()
+  if (!topicId || !text) return Response.json({ success: false, error: 'emptyError' })
+  if (!(await topicIsReplyable(topicId))) return Response.json({ success: false, error: 'topicLocked' })
+  await createPost(topicId, session.username, session.accountId, text)
+  return Response.json({ success: true })
+}

web-next/app/api/forum/topic/route.ts

@@ -0,0 +1,16 @@
+import { getSession } from '@/lib/session'
+import { createTopic, forumIsPostable } from '@/lib/forum-write'
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId || !session.username) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  let b: Record<string, string> = {}
+  try { b = await request.json() } catch { return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 }) }
+  const forumId = Number(b.forumId)
+  const name = String(b.name ?? '').trim()
+  const text = String(b.text ?? '').trim()
+  if (!forumId || !name || !text) return Response.json({ success: false, error: 'emptyError' })
+  if (!(await forumIsPostable(forumId))) return Response.json({ success: false, error: 'invalidForum' })
+  const topicId = await createTopic(forumId, name, session.username, session.accountId, text)
+  return Response.json({ success: true, topicId })
+}