fix(vip): render 开通会员更多内容 as HTML in the modal

Three layers were dropping the markup: the save path was already relaxed to wp_kses_post via schema sanitize_type html, but the runtime output re-filtered more through the narrow equity whitelist (h/img/hr/table stripped), and pay-vip.js inserted it with node() whose textContent showed the tags as literal text. The card-pass desc had the same output-side strip despite its save-side fix.

- PaymentRuntime: more and pay_vip_pass_charge_desc now output via wp_kses_post, matching the save-time level (repo precedent: revenue note, after-sale desc)

- pay-vip.js: new htmlNode() helper (innerHTML) for server-sanitized rich text; more and cardPass.desc use it, plain-text fields keep node()

Verification: 3 new contract tests cover output-level kses and innerHTML rendering; node --test tests/**/*.test.cjs 640/640 pass; php -l and node --check clean.

tests/widget-system/vip-modal-copy-fields.test.cjs

@@ -156,3 +156,19 @@ test('开通会员更多内容只在弹窗内渲染，不裸露在用户中心
   assert.match(modalSource, /'more'\s+=>/);
   assert.match(payVipJs, /catalog\.more/);
 });
+
+test('more 与卡密说明输出按 post 级 HTML 放行', () => {
+  // 保存端已 wp_kses_post，输出端不能再窄白名单/textarea 净化二次剥标签。
+  const vipSettings = slice(paymentRuntime, 'public static function get_payment_vip_settings', 'public static function get_payment_revenue_settings');
+  assert.match(vipSettings, /'more'\s+=> wp_kses_post\(\$more\)/);
+  assert.doesNotMatch(vipSettings, /\$allowed_equity \+ \['div'/);
+  const rechargeSettings = slice(paymentRuntime, 'public static function get_payment_recharge_settings', 'public static function get_payment_vip_settings');
+  assert.match(rechargeSettings, /'desc'\s+=> wp_kses_post\(\(string\) \(\$settings\['pay_vip_pass_charge_desc'\]/);
+});
+
+test('弹窗内 more 与卡密说明按 HTML 渲染而非纯文本', () => {
+  // node() 走 textContent 会把标签显示为字面文本；富文本字段必须走 innerHTML。
+  assert.match(payVipJs, /function htmlNode\(tag, className, value\) \{[\s\S]*?el\.innerHTML = text\(value\);/);
+  assert.ok(payVipJs.includes('htmlNode("div", "muted-2-color mb10 em09 muted-box padding-10 mini-radius", catalog.more)'));
+  assert.ok(payVipJs.includes('htmlNode("div", "muted-box muted-2-color padding-10 mb10 em09", cardPass.desc)'));
+});