fix: register DOMPurify hooks once, abort featured upload, fix double drop

- Register DOMPurify hooks at module init (not per sanitizeHtml call)
- Always set iframe allow attribute (not conditional on existing)
- Add AbortController to featured image upload for unmount cleanup
- Check defaultPrevented in React onDrop to prevent double upload with TipTap
- Remove explicit Content-Type header on upload (axios auto-sets boundary)

src/api/news.ts

@@ -64,7 +64,7 @@ export const newsApi = {
     const response = await apiClient.post<NewsMediaUploadResponse>(
       '/cabinet/admin/news/media/upload',
       formData,
-      { headers: { 'Content-Type': 'multipart/form-data' }, signal },
+      { signal },
     );
     return response.data;
   },