fix: strip HTML tags from derived excerpt

gsub(/<[^>]+>/, '') before stripping markdown markup, so auto-generated
excerpts don't leak raw HTML from post bodies.

CHANGELOG.md

@@ -12,6 +12,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `<pubDate>` in RSS feed items, derived from the post date.
 - `<lastmod>` in sitemap entries for SEO.
 - In-memory rate limiting on the login endpoint: 10 attempts per 60 seconds per IP.
+- `<language>` element in the RSS feed channel.
+- Periodic cleanup of stale `login_attempts` entries to prevent unbounded memory growth.
 
 ### Changed
 
@@ -22,6 +24,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `admin.session_ttl` was defined but never read; it now controls
   `Rack::Session::Cookie` expiration via `expire_after`.
+- Derived post excerpts now strip HTML tags before stripping markdown markup,
+  avoiding raw HTML leaks in auto-generated excerpts.
 
 ## [0.1.0] — 2026-06-20