[PathGao]

A raw HTML player pointing at a file next to the document showed its controls but never loaded:

<video controls src="clips/demo.mp4"></video>
<video controls><source src="clips/demo.mp4" type="video/mp4"></video>

Found and first fixed by @August-At-Play in #1075. This keeps that fix's two parts and leaves out the rest, so the image path does not change.

Mechanism

• processBlockMarkup resolved local <img> sources against the document, but not video[src], audio[src] or their <source> children, so those resolved against the webview.
• The CSP had no media-src, so media fell back to default-src 'self', which refuses Windows' http://asset.localhost.

The image code is now localSrc, unchanged, and the media elements go through it too, before the images, whose media links (![](x.mp4)) become players with a src already converted. media-src allows the same two asset spellings img-src does.

Scope

• No file: URLs. Images do not take them either. Paths are written relative to the document or absolute, as for images.
• Web video stays blocked by the CSP, as before.

Tests

preview.localMedia.test.ts runs processMarkdownHtml over a direct src, a nested <source> and a media link written as an image. The first goes red without the fix, the last goes red if the two loops swap order. A config test pins media-src, and goes red without it.

Verification

• npm run check, npm run lint, npm test (958 passed), npx vitest run (770 passed), vite build and check-startup-chunk, cargo fmt --check, cargo test --locked (249 passed), bindings unchanged.
• In a macOS test build, a direct src, a nested <source> with a space in the file name, and an image-syntax link all played.
• Not run on Windows or Linux.