bug(web-ui): make system message HTML sink safe by default

[lidge-jun]

Summary

addSystemMsg() still injects raw HTML into the DOM via innerHTML, while some call sites pass interpolated Error.message or t() output. A few call sites were hardened, but the sink itself is still unsafe-by-contract.

Current Review Status

• Partial after the 2026-04-18 pull audit
• public/js/features/chat.ts now escapes some messages
• public/js/ui.ts:116-124 still does div.innerHTML = text
• public/js/features/i18n.ts:46-51 still interpolates raw values via String(v)

Why This Matters

A future call site can easily forget to escape user-controlled text and reopen an XSS / markup-injection path.

Suggested Scope

• Make addSystemMsg() safe by default
• Move icon/emphasis rendering to DOM composition or a branded/trusted HTML contract
• Harden t() interpolation or force escaping at call sites

Evidence

• public/js/ui.ts:116-124
• public/js/features/chat.ts:100,102,122,144,381
• public/js/features/i18n.ts:46-51

[lidge-jun]

2026-04-27 cleanup status: keeping this open.

The unsafe-by-contract system-message HTML sink is still a live P1 Web UI hardening item. This should stay open until addSystemMsg() is safe by default and trusted markup, if any, is explicit and tested.