fix: prevent DOM XSS in text diff, Markdown preview, and regex output

[cursor]

Summary

Fixes a DOM-based XSS in the static index.html tool page: user-controlled text was inserted into innerHTML without escaping in three places (text diff, Markdown preview, regex match highlights).

Bug and impact

• Impact: A user pasting crafted HTML/JS in those tools could execute script in the same origin (e.g. steal session cookies on same-site apps, deface the page, or phish in the same tab). Severity is high for any deployment where this page shares origin with sensitive apps; it is still a real XSS class bug on GitHub Pages–hosted static sites.

Root cause

• textDiff() built HTML from line strings with ${la} / ${lb} unescaped.
• renderMD() ran markdown transforms on raw input, then assigned to innerHTML — any <script> or event handlers in input executed.
• testRegex() embedded match substrings in innerHTML unescaped.

Fix

• Added escapeHtml() and used it for diff lines, for Markdown input (before applying the simple regex-based “markdown” rules), and for each regex match string when building the result HTML.

Validation

• Manual code review: all three innerHTML write paths that mixed user text with markup now escape that text first.
• No package.json / test runner in repo; no automated tests added.