fix(widgets): preserve badge HTML in icon card title/desc like reference theme

wp_kses_post() strips the custom <badge> element, so icon card title/desc
lost admin-authored markup (e.g. <badge class="ml6 jb-blue">GO</badge>)
both at save time and render time, diverging from the reference theme
which stores and echoes these fields raw.

- add shared inline whitelist (aksrt_icon_card_kses_tags/aksrt_icon_card_kses)
  and route both card renderers plus the media-brand fallback through it
- drop the dead unused $allow array in aksrt_icon_cover_card
- add 'rich_html' sanitize type (FieldSchema + SchemaProvider) and mark
  icon card title/desc fields in widget schemas, page display schema and
  the page config meta box save path
- align header slider card module with reference show_widget_bg branches
  (aksrt-panel/flex1 vs padding-10 wrapper/relative-h)
- update widget contract tests to pin the whitelist behavior

src/Admin/PageConfigMetaBox.php

@@ -250,8 +250,10 @@ final class PageConfigMetaBox {
 			}
 			$link = is_array($card['link'] ?? null) ? $card['link'] : [];
 			$cards[] = [
-				'title'          => wp_kses_post((string) ($card['title'] ?? '')),
-				'desc'           => wp_kses_post((string) ($card['desc'] ?? '')),
+				// legacy echoes card title/desc raw (admin authors <badge> etc.);
+				// wp_kses_post() would strip the custom badge element.
+				'title'          => aksrt_icon_card_kses((string) ($card['title'] ?? '')),
+				'desc'           => aksrt_icon_card_kses((string) ($card['desc'] ?? '')),
 				// Icon picker values may carry an inline "customsvg-<svg>" payload;
 				// sanitize_text_field would strip it down to a bare prefix.
 				'icon'           => function_exists('aksrt_sanitize_icon_value')

src/Admin/Schema/SchemaPageDisplay.php

@@ -181,7 +181,7 @@ class SchemaPageDisplay {
 	}
 
 	private static function card_fields(): array {
-		return [self::field('icon_radius4', '方形图标', 'switcher', false), self::field('cards', '添加卡片', 'group', [], ['button_title' => '添加内容', 'fields' => [self::field('title', '文案标题', 'textarea', '', ['sanitize_type' => 'html']), self::field('desc', '文案简介', 'textarea', '', ['sanitize_type' => 'html']), self::field('icon', '选择图标', 'icon', 'fa fas fa-magic'), self::field('customize_icon', '自定义图标', 'textarea', '', ['sanitize_type' => 'html']), self::field('icon_class', '图标颜色', 'palette', 'c-yellow', ['options' => self::aksrt_palette(true)]), self::field('link', '跳转链接', 'link', [])]])];
+		return [self::field('icon_radius4', '方形图标', 'switcher', false), self::field('cards', '添加卡片', 'group', [], ['button_title' => '添加内容', 'fields' => [self::field('title', '文案标题', 'textarea', '', ['sanitize_type' => 'rich_html']), self::field('desc', '文案简介', 'textarea', '', ['sanitize_type' => 'rich_html']), self::field('icon', '选择图标', 'icon', 'fa fas fa-magic'), self::field('customize_icon', '自定义图标', 'textarea', '', ['sanitize_type' => 'html']), self::field('icon_class', '图标颜色', 'palette', 'c-yellow', ['options' => self::aksrt_palette(true)]), self::field('link', '跳转链接', 'link', [])]])];
 	}
 
 	private static function orderby_fields(): array { return [self::field('lists', '显示排序方式', 'select', ['modified', 'views', 'like', 'comment_count'], ['multiple' => true, 'sortable' => true, 'options' => self::post_order_options(false)]), self::field('dropdown', '更多排序方式', 'switcher', false)]; }

src/Admin/SchemaProvider.php

@@ -821,6 +821,13 @@ class SchemaProvider {
 				return array_values(array_unique($ids));
             case 'html':
                 return wp_kses_post((string) $value);
+            case 'rich_html':
+                // Inline whitelist for card title/desc: `badge` is a custom
+                // element that wp_kses_post() would strip, but legacy (Zibll)
+                // renders such markup verbatim.
+                return function_exists('aksrt_icon_card_kses')
+                    ? aksrt_icon_card_kses((string) $value)
+                    : wp_kses_post((string) $value);
             case 'textarea':
                 return sanitize_textarea_field((string) $value);
             case 'code':