fix: keep redaction marks correct with custom masks, Prism and Mermaid

- The mask from /api/options is stored once loaded; code markers and
  rendered Markdown are refreshed when it arrives instead of keeping the
  XXXX default.
- Mermaid sources are left untouched so diagrams still parse.
- Fenced code blocks are marked from a Prism complete hook, after Prism
  has rewritten their HTML.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/frontend-regressions.test.js

@@ -247,4 +247,20 @@ describe("redaction highlighting", () => {
     expect(html).to.include('href="https://x.test/XXXX-2"');
     expect(highlightRedactions("<p>nothing here</p>", "XXXX")).to.equal("<p>nothing here</p>");
   });
+  it("leaves Mermaid sources and Prism code blocks for their renderers", () => {
+    const { highlightRedactions } = helpers();
+    const html = highlightRedactions('<div class="mermaid">graph TD; XXXX-1--&gt;B</div><pre><code class="language-py">print("XXXX-2")</code></pre><code>XXXX-3</code>', "XXXX");
+    expect(html).to.include('<div class="mermaid">graph TD; XXXX-1--&gt;B</div>');
+    expect(html).to.include('<code class="language-py">print("XXXX-2")</code>');
+    expect(html).to.include('<code><mark class="redaction" title="Redacted by Anonymous GitHub">XXXX-3</mark></code>');
+  });
+  it("marks a highlighted code block when Prism hands it over, using the configured mask", () => {
+    const { window } = new (require("jsdom").JSDOM)('<pre><code class="language-py"><span class="token string">"MASK-4"</span></code></pre>');
+    const h = harness();
+    Object.assign(h.context, { DOMParser: window.DOMParser, NodeFilter: window.NodeFilter });
+    h.defs.setRedactionMask("MASK");
+    const code = window.document.querySelector("code");
+    h.defs.markRedactionsIn(code);
+    expect(code.querySelector("mark.redaction").textContent).to.equal("MASK-4");
+  });
 });