fix(vip): render 开通会员更多内容 as HTML in the modal

Three layers were dropping the markup: the save path was already relaxed to wp_kses_post via schema sanitize_type html, but the runtime output re-filtered more through the narrow equity whitelist (h/img/hr/table stripped), and pay-vip.js inserted it with node() whose textContent showed the tags as literal text. The card-pass desc had the same output-side strip despite its save-side fix.

- PaymentRuntime: more and pay_vip_pass_charge_desc now output via wp_kses_post, matching the save-time level (repo precedent: revenue note, after-sale desc)

- pay-vip.js: new htmlNode() helper (innerHTML) for server-sanitized rich text; more and cardPass.desc use it, plain-text fields keep node()

Verification: 3 new contract tests cover output-level kses and innerHTML rendering; node --test tests/**/*.test.cjs 640/640 pass; php -l and node --check clean.

src/Settings/PaymentRuntime.php

@@ -121,7 +121,9 @@ class PaymentRuntime {
                 ],
                 'vip'     => [
                     'enabled'       => !empty($settings['pay_vip_pass_charge_s']),
-                    'desc'          => sanitize_textarea_field((string) ($settings['pay_vip_pass_charge_desc'] ?? '')),
+                    // 保存端已按 post 级 HTML 放行（schema sanitize_type html），
+                    // 输出端不能再被 textarea 净化剥掉标签。
+                    'desc'          => wp_kses_post((string) ($settings['pay_vip_pass_charge_desc'] ?? '')),
                     // 默认非单密码（卡号+密码），对齐参考主题 pay_vip_pass_charge_only_password 默认 false。
                     'only_password' => !empty($settings['pay_vip_pass_charge_only_password']),
                 ],
@@ -218,7 +220,9 @@ class PaymentRuntime {
             'name'          => $vip1_enabled ? $name1 : $badge,
             'badge_text'    => $badge,
             'desc'          => $desc,
-            'more'          => wp_kses($more, $allowed_equity + ['div' => ['class' => true], 'p' => ['class' => true]]),
+            // 管理员编辑的富文本说明：与保存端同为 post 级 HTML（wp_kses_post），
+            // 不再用权益列表的窄白名单二次剥标签（h/img/hr/table 等）。
+            'more'          => wp_kses_post($more),
             'levels'        => [
                 1 => [
                     'enabled'        => $vip1_enabled,