fix(widgets): preserve badge HTML in icon card title/desc like reference theme

wp_kses_post() strips the custom <badge> element, so icon card title/desc
lost admin-authored markup (e.g. <badge class="ml6 jb-blue">GO</badge>)
both at save time and render time, diverging from the reference theme
which stores and echoes these fields raw.

- add shared inline whitelist (aksrt_icon_card_kses_tags/aksrt_icon_card_kses)
  and route both card renderers plus the media-brand fallback through it
- drop the dead unused $allow array in aksrt_icon_cover_card
- add 'rich_html' sanitize type (FieldSchema + SchemaProvider) and mark
  icon card title/desc fields in widget schemas, page display schema and
  the page config meta box save path
- align header slider card module with reference show_widget_bg branches
  (aksrt-panel/flex1 vs padding-10 wrapper/relative-h)
- update widget contract tests to pin the whitelist behavior

src/Admin/PageConfigMetaBox.php

@@ -250,8 +250,10 @@ final class PageConfigMetaBox {
 			}
 			$link = is_array($card['link'] ?? null) ? $card['link'] : [];
 			$cards[] = [
-				'title'          => wp_kses_post((string) ($card['title'] ?? '')),
-				'desc'           => wp_kses_post((string) ($card['desc'] ?? '')),
+				// legacy echoes card title/desc raw (admin authors <badge> etc.);
+				// wp_kses_post() would strip the custom badge element.
+				'title'          => aksrt_icon_card_kses((string) ($card['title'] ?? '')),
+				'desc'           => aksrt_icon_card_kses((string) ($card['desc'] ?? '')),
 				// Icon picker values may carry an inline "customsvg-<svg>" payload;
 				// sanitize_text_field would strip it down to a bare prefix.
 				'icon'           => function_exists('aksrt_sanitize_icon_value')