Jul 24 - Update Rich-text editor to support uploading images and inserting table

README.md

@@ -183,13 +183,20 @@ Then visit `https://your-domain/admin`, sign in, and manage content.
   change, newest first, filterable by action and type, paginated 50/page. Times
   are UTC.
 
-The editor (Quill) and drag library (SortableJS) are **vendored locally** under
+The editor (Quill 2) and drag library (SortableJS) are **vendored locally** under
 `static/vendor/` — no CDN dependency, so they work on a locked-down server and
-survive a strict CSP. Rich-text HTML is sanitized on save (`bleach`) against a
-tag allowlist, so a paste can't inject markup or `javascript:` links into the
-public page. If the editor ever fails to load, the body field degrades to a
+survive a strict CSP. The body toolbar supports **inline images** and **tables**
+(Quill 2's built-in table module: insert, add/remove rows & columns). Images are
+uploaded via `POST /admin/upload` — the file is stored under `static/uploads/`
+and referenced by URL, so the database stays small (no base64). Rich-text HTML is
+sanitized on save (`bleach`) against a tag allowlist that now includes `img` and
+table tags, so a paste can't inject markup, `javascript:`, or `data:` URLs into
+the public page. If the editor ever fails to load, the body field degrades to a
 plain textarea — a save never wipes content.
 
+`static/uploads/` must be writable by the app user (`jqc`) in production:
+`sudo -u jqc mkdir -p static/uploads`. Uploaded files are gitignored.
+
 ### Notes
 
 - `SESSION_COOKIE_SECURE=1` means the login cookie only sends over HTTPS. For a