feat: implement HTML rendering for readme sections

Replace the _render_section_html stub with a working implementation that
converts parsed bullet-list nodes into classed div elements (entry,
entry-sub, subcat). Add _render_bullet_list_html to handle nested
structure and XSS escaping. Cover all cases with a new
TestRenderSectionHtml suite.

Co-Authored-By: Claude <noreply@anthropic.com>

website/readme_parser.py

@@ -269,11 +269,67 @@ def _parse_section_entries(content_nodes: list[SyntaxTreeNode]) -> list[ParsedEn
     return entries
 
 
-# --- Content HTML rendering (stub for Task 4) --------------------------------
+# --- Content HTML rendering --------------------------------------------------
+
+
+def _render_bullet_list_html(
+    bullet_list: SyntaxTreeNode,
+    *,
+    is_sub: bool = False,
+) -> str:
+    """Render a bullet_list node to HTML with entry/entry-sub/subcat classes."""
+    out: list[str] = []
+
+    for list_item in bullet_list.children:
+        if list_item.type != "list_item":
+            continue
+
+        inline = _find_inline(list_item)
+        if inline is None:
+            continue
+
+        first_link = _find_first_link(inline)
+
+        if first_link is None:
+            # Subcategory label
+            label = str(escape(render_inline_text(inline.children)))
+            out.append(f'<div class="subcat">{label}</div>')
+            nested = _find_child(list_item, "bullet_list")
+            if nested:
+                out.append(_render_bullet_list_html(nested, is_sub=False))
+            continue
+
+        # Entry with a link
+        name = str(escape(render_inline_text(first_link.children)))
+        url = str(escape(first_link.attrGet("href") or ""))
+
+        if is_sub:
+            out.append(f'<div class="entry-sub"><a href="{url}">{name}</a></div>')
+        else:
+            desc = _extract_description_html(inline, first_link)
+            if desc:
+                out.append(
+                    f'<div class="entry"><a href="{url}">{name}</a>'
+                    f'<span class="sep">&mdash;</span>{desc}</div>'
+                )
+            else:
+                out.append(f'<div class="entry"><a href="{url}">{name}</a></div>')
+
+        # Nested items under an entry with a link are sub-entries
+        nested = _find_child(list_item, "bullet_list")
+        if nested:
+            out.append(_render_bullet_list_html(nested, is_sub=True))
+
+    return "\n".join(out)
 
 
 def _render_section_html(content_nodes: list[SyntaxTreeNode]) -> str:
-    return ""
+    """Render a section's content nodes to HTML."""
+    parts: list[str] = []
+    for node in content_nodes:
+        if node.type == "bullet_list":
+            parts.append(_render_bullet_list_html(node))
+    return "\n".join(parts)
 
 
 # --- Section splitting -------------------------------------------------------

website/tests/test_readme_parser.py

@@ -5,7 +5,13 @@ import sys
 import textwrap
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
-from readme_parser import _parse_section_entries, parse_readme, render_inline_html, render_inline_text
+from readme_parser import (
+    _parse_section_entries,
+    _render_section_html,
+    parse_readme,
+    render_inline_html,
+    render_inline_text,
+)
 
 from markdown_it import MarkdownIt
 from markdown_it.tree import SyntaxTreeNode
@@ -303,3 +309,48 @@ class TestParseSectionEntries:
         entries = _parse_section_entries(nodes)
         assert "<script>" not in entries[0]["description"]
         assert "&lt;script&gt;" in entries[0]["description"]
+
+
+class TestRenderSectionHtml:
+    def test_basic_entry(self):
+        nodes = _content_nodes("- [django](https://example.com) - A web framework.\n")
+        html = _render_section_html(nodes)
+        assert 'class="entry"' in html
+        assert 'href="https://example.com"' in html
+        assert "django" in html
+        assert "A web framework." in html
+
+    def test_subcategory_label(self):
+        nodes = _content_nodes(
+            "- Synchronous\n  - [django](https://x.com) - Framework.\n"
+        )
+        html = _render_section_html(nodes)
+        assert 'class="subcat"' in html
+        assert "Synchronous" in html
+        assert 'class="entry"' in html
+
+    def test_sub_entry(self):
+        nodes = _content_nodes(
+            "- [django](https://x.com) - Framework.\n"
+            "  - [awesome-django](https://y.com)\n"
+        )
+        html = _render_section_html(nodes)
+        assert 'class="entry-sub"' in html
+        assert "awesome-django" in html
+
+    def test_link_only_entry(self):
+        nodes = _content_nodes("- [tool](https://x.com)\n")
+        html = _render_section_html(nodes)
+        assert 'class="entry"' in html
+        assert 'href="https://x.com"' in html
+        assert "tool" in html
+
+    def test_xss_escaped_in_name(self):
+        nodes = _content_nodes('- [<img onerror=alert(1)>](https://x.com) - Bad.\n')
+        html = _render_section_html(nodes)
+        assert "onerror" not in html or "&" in html
+
+    def test_xss_escaped_in_subcat(self):
+        nodes = _content_nodes("- <script>alert(1)</script>\n")
+        html = _render_section_html(nodes)
+        assert "<script>" not in html