Jul 22 - Update - add Rich-text editor, draft/publish, drag-to-reorder

README.md

@@ -138,11 +138,12 @@ CSRF-protected forms, and every create/update/delete is written to `audit_log`.
 
 ### One-time setup
 
-1. **Already-deployed DB?** add the audit table:
+1. **Already-deployed DB?** add the audit table and the publish column:
    ```bash
-   sudo mysql < add_admin.sql
+   sudo mysql < add_admin.sql      # audit_log (admin panel)
+   sudo mysql < add_publish.sql    # topic.is_published (draft/publish)
    ```
-   (New deploys skip this — `schema.sql` already includes `audit_log`.)
+   (New deploys skip this — `schema.sql` already includes both.)
 
 2. Set these in `/opt/jqc-features/.env`:
    ```bash
@@ -167,14 +168,28 @@ Then visit `https://your-domain/admin`, sign in, and manage content.
 ### What you can do
 
 - **Dashboard** — every section with its topics; edit or delete inline.
-- **Add / edit topic** — section, title, slug (auto if blank), body HTML, media
-  (image / video / embed), caption, an optional link button, and sort order.
+  **Drag the ⠿ handles** to reorder topics within a section, or reorder whole
+  sections; the new order saves instantly (no page reload).
+- **Publish / Unpublish** — each topic has a one-click toggle, and a Published
+  checkbox on its edit form. Drafts show a `draft` badge and are hidden from the
+  public site. A section whose topics are all drafts is hidden entirely.
+- **Add / edit topic** — section, title, slug (auto if blank), a **rich-text
+  body editor** (bold/italic/underline, H2/H3, lists, blockquote, links — no HTML
+  knowledge needed), media (image / video / embed) + caption, an optional link
+  button, and sort order.
 - **Add / edit section** — number (`§NN`, unique), title, subtitle, sort order.
 - Deleting a section cascades to its topics (with a confirm prompt).
 - **Audit log** (`/admin/audit`, "Audit" in the nav) — read-only view of every
   change, newest first, filterable by action and type, paginated 50/page. Times
   are UTC.
 
+The editor (Quill) and drag library (SortableJS) are **vendored locally** under
+`static/vendor/` — no CDN dependency, so they work on a locked-down server and
+survive a strict CSP. Rich-text HTML is sanitized on save (`bleach`) against a
+tag allowlist, so a paste can't inject markup or `javascript:` links into the
+public page. If the editor ever fails to load, the body field degrades to a
+plain textarea — a save never wipes content.
+
 ### Notes
 
 - `SESSION_COOKIE_SECURE=1` means the login cookie only sends over HTTPS. For a