The renderContent() function used dangerouslySetInnerHTML without
first sanitizing the AI-generated text, allowing any HTML in the
model response to execute in the browser. Added escHtml() helper
and applied it before the bold-substitution regex.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>