fix: escape debug title (XSS) and make test suite order-independent

Issue #13: data["html"]["title"] was embedded into the debug HTML of
/post/html without escaping; title never passes through bleach, so a post
whose generated title carries markup (e.g. a poll question) was a reflected
XSS under ?debug=true. Escape it with html.escape, same as raw_message.
Add a regression test with a <script> payload in a poll question.

Issue #17: a bare 'pytest' from the repo root failed 22 tests because the
config in tests/pytest.ini was not picked up (asyncio_mode lost, .venv
collected) and every test module polluted sys.modules['config'] at import
time. Move the config to a root pytest.ini with testpaths=tests, and
centralize the sys.path bootstrap + config mock in tests/conftest.py, which
pytest imports before any test module. Drop the per-module preambles.

Closes #13, closes #17

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_postparser_extract_flags.py

@@ -7,14 +7,6 @@
 
 import unittest
 from unittest.mock import MagicMock, PropertyMock
-import sys
-import os
-
-# Add project root to sys.path to find post_parser
-sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..')))
-
-# Mock the config module before importing PostParser
-sys.modules['config'] = __import__('tests.mock_config', fromlist=['get_settings'])
 
 from pyrogram.types import Message, Chat, Reaction, MessageReactions
 from pyrogram.enums import MessageMediaType