fix: strip HTML-encoded tags (decode entities before stripping)

The previous stripHtml decoded </> after the regex pass, so content
stored as <p>text</p> was never stripped. Now entities are
decoded first, then all tags are removed.

Also strip HTML when prefilling compose from an existing post (Edit/Repost)
so the text field shows clean content, not raw markup.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

artifacts/postiz-mobile/app/(tabs)/posts.tsx

@@ -22,6 +22,7 @@ import { PostCard } from "@/components/PostCard";
 import { PostizPost, usePostiz } from "@/context/PostizContext";
 import { useColors } from "@/hooks/useColors";
 import { extractError } from "@/lib/extractError";
+import { stripHtml } from "@/lib/stripHtml";
 
 const SORT_STORAGE_KEY = "postiz_posts_sort";
 
@@ -154,7 +155,7 @@ export default function PostsScreen() {
     router.push({
       pathname: "/(tabs)/compose",
       params: {
-        prefillContent: post.content,
+        prefillContent: stripHtml(post.content),
         prefillIntegrationIds: integrations.map((i) => i.id).join(","),
       },
     });
@@ -193,14 +194,15 @@ export default function PostsScreen() {
   const showContextMenu = (post: PostizPost) => {
     Haptics.impactAsync(Haptics.ImpactFeedbackStyle.Medium);
 
-    const preview = post.content.slice(0, 60) + (post.content.length > 60 ? "…" : "");
+    const plain = stripHtml(post.content);
+    const preview = plain.slice(0, 60) + (plain.length > 60 ? "…" : "");
 
     const buttons: Array<{ text: string; style?: "cancel" | "destructive" | "default"; onPress?: () => void }> = [];
 
     buttons.push({
       text: "Copy text",
       onPress: async () => {
-        await Clipboard.setStringAsync(post.content);
+        await Clipboard.setStringAsync(stripHtml(post.content));
         Haptics.notificationAsync(Haptics.NotificationFeedbackType.Success);
         setCopyToast(true);
         setTimeout(() => setCopyToast(false), 2000);

artifacts/postiz-mobile/components/PostCard.tsx

@@ -12,6 +12,7 @@ import {
 import { Swipeable } from "react-native-gesture-handler";
 import { useColors } from "@/hooks/useColors";
 import { PostizPost } from "@/context/PostizContext";
+import { stripHtml } from "@/lib/stripHtml";
 import { StatusBadge } from "./StatusBadge";
 
 interface PostCardProps {
@@ -118,10 +119,11 @@ export function PostCard({ post, onDelete, onLongPress, onReschedule }: PostCard
       : undefined;
 
   const integrations = post.integrations ?? (post.integration ? [post.integration] : []);
+  const plainContent = stripHtml(post.content);
   const truncatedContent =
-    post.content.length > 140
+    plainContent.length > 140
-      ? post.content.slice(0, 140) + "…"
+      ? plainContent.slice(0, 140) + "…"
-      : post.content;
+      : plainContent;
 
   return (
     <Swipeable

artifacts/postiz-mobile/lib/stripHtml.ts

@@ -0,0 +1,19 @@
+export function stripHtml(html: string): string {
+  // Decode entities first so encoded tags like <p> are also stripped
+  let s = html
+    .replace(/&/g, "&")
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&nbsp;/g, " ");
+  // Block-level tags → newlines
+  s = s
+    .replace(/<br\s*\/?>/gi, "\n")
+    .replace(/<\/p>/gi, "\n")
+    .replace(/<\/div>/gi, "\n")
+    .replace(/<\/li>/gi, "\n");
+  // Strip all remaining tags
+  s = s.replace(/<[^>]+>/g, "");
+  return s.replace(/\n{3,}/g, "\n\n").trim();
+}