the URL gets html escaped twice

[lyricat]

similar issue: #55
symptos:

![Google](https://google.com?a=1&b=2)

will become:

![Google](https://google.com?a=1&b=2)

it leads to incorrect alignment.

cause:

First escape: the entire line is escaped up front in src/parser.js:394
Second escape: when restoring the link sanctuary, the code escapes the URL again in src/parser.js:358

[panphora]

Fixed in v2.0! URLs are now escaped exactly once at entry, and the sanctuary pattern preserves that escaped form.

All XSS protections remain in place via sanitizeUrl(). Added comprehensive test coverage for URLs with ampersands, angle brackets, quotes, and other special characters.

Thanks @lyricat for the detailed bug report with exact line numbers - made the fix straightforward!

[panphora]

I did the best I could to test OverType before the v2.0 release, but please test it thoroughly and report bugs. I changed a lot and I only have so much bandwidth to test myself.

[lyricat]

sure sure, thank you for the hard work. I will ask my users to test the latest version.