fix: define shared html escaping helper

[saurabhhhcodes]

Summary

• add a shared escapeHTML utility for the existing interpolated HTML rendering paths
• import it into src/app.js so the current callsites no longer throw ReferenceError
• add a regression validator that checks escaping for HTML/script-sensitive characters and nullish values

Validation

• node --check src/html-utils.js
• node --check src/app.js
• node --check scripts/validate-escape-html.mjs
• npm test
• npm run build
• git diff --check

Fixes #551

[saurabhhhcodes]

Validation completed locally:

• node --check src/html-utils.js
• node --check src/app.js
• node --check scripts/validate-escape-html.mjs
• npm test
• npm run build
• git diff --check

The PR is merge-clean from GitHub and scoped to #551. Could maintainers please add the relevant GSSoC scoring labels if this fix is accepted, since the issue currently has no labels on GitHub?