Escape HTML entities before rendering AI insight content

The renderContent() function used dangerouslySetInnerHTML without
first sanitizing the AI-generated text, allowing any HTML in the
model response to execute in the browser. Added escHtml() helper
and applied it before the bold-substitution regex.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/pages/Dashboard.tsx

@@ -23,9 +23,17 @@ function formatAge(iso: string): string {
   return `${Math.floor(hours / 24)}d ago`
 }
 
+function escHtml(s: string): string {
+  return s
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
 function renderContent(text: string) {
   return text.split('\n').map((line, i) => {
-    const processed = line.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
+    const safe = escHtml(line)
+    const processed = safe.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
     if (line.startsWith('- ') || line.startsWith('* ')) {
       return (
         <div key={i} style={{ display: 'flex', gap: 8, marginBottom: 4 }}>