fix(security): Prevent DOM XSS in Markdown, text diff, and regex outputs

[cursor]

Bug and impact

DOM-based XSS in three client-only tools: anyone who pastes crafted text (or opens a shared snippet) could run arbitrary JavaScript in the victim’s origin. That can lead to session/token theft if the site later adds auth, malicious redirects, or defacement.

Concrete triggers

1. Markdown 预览: paste # <img src=x onerror=alert(1)> — the old pipeline injected raw HTML into #md-preview via innerHTML.
2. 文本对比: a line containing <img src=x onerror=alert(1)> was concatenated into diff HTML unchanged.
3. 正则测试: a match substring containing HTML tags was written into innerHTML unescaped.

Root cause

User input (or match substrings / error messages) was interpolated into template strings assigned to element.innerHTML without HTML entity encoding.

Fix

• Add escapeHtml() and use it before Markdown regex transforms (markdown syntax still works; angle brackets in content are neutralized).
• Escape line content in textDiff() and match / error strings in testRegex().

Validation

• Ran node scripts/verify-security.mjs (asserts escapeHtml behavior and that index.html contains the expected guard patterns).