Harden all string-based rendering paths to avoid unsafe HTML injection

[blackopsrepl]

Summary

Remove unsafe default HTML insertion paths or make them explicitly opt-in.

Problem

Several APIs inject raw HTML strings with innerHTML. That makes the library unsafe by default when user-provided content reaches those APIs.

Scope

• Audit all rendering paths that accept string content
• Replace innerHTML usage with safe DOM construction where practical
• If raw HTML support remains, require an explicit opt-in API and document the risk clearly
• Add tests covering escaped content and any approved raw-HTML path

Acceptance Criteria

• Default rendering paths do not inject untrusted HTML directly
• Any remaining raw HTML API is explicit, narrowly scoped, and documented as unsafe
• Covered components preserve expected rendering without relying on unsafe insertion
• Tests verify safe handling of markup-like user content

Notes

This is a production-safety issue and should be treated as blocking for broader adoption.

[blackopsrepl]

Resolved by merged PR #21: https://github.com/SolverForge/solverforge-ui/pull/21\n\nWhat shipped:\n- now renders strings as text by default instead of raw HTML\n- explicit opt-in unsafe HTML paths were added (, , , , )\n- modal/tab/table/gantt rendering paths were updated to stay text-safe by default\n- regression tests were added for safe rendering and the namespaced Gantt SVG path\n\nClosing this issue because the hardening work is merged on .

[blackopsrepl]

Resolved by merged PR #21: #21

What shipped:

• SF.el now renders strings as text by default instead of raw HTML
• explicit opt-in unsafe HTML paths were added (unsafeHtml, unsafeBody, tabs[].content.unsafeHtml, cells[].unsafeHtml, unsafePopupHtml)
• modal/tab/table/gantt rendering paths were updated to stay text-safe by default
• regression tests were added for safe rendering and the namespaced Gantt SVG path

Closing this issue because the hardening work is merged on main.