fix: sanitize search snippets to prevent XSS from indexed summaries

[farce1]

Motivation

• The FTS upsert concatenates user-editable or LLM-generated summary content into the meetings_fts.transcript_text column which is later used by SQLite snippet() and returned as raw HTML.
• Search snippets were rendered with dangerouslySetInnerHTML without sanitization, creating an XSS vector if a summary contains HTML/JS.

Description

• Added sanitizeSearchSnippetHtml to src/views/LibraryView.tsx which HTML-escapes snippet content and then allowlists the <mark> tag so FTS highlight markup still renders.
• Updated renderSearchSnippet to return sanitized HTML via the new sanitizer while preserving existing dangerouslySetInnerHTML usage.
• Change is minimal and client-side only and keeps search highlighting behavior while preventing arbitrary HTML/JS execution from snippets.

Testing

• Ran npm test which completed successfully (14 tests passed).
• Ran npm run build; the first build failed due to use of String.replaceAll, then the sanitizer was adjusted to use regex replace calls and the subsequent npm run build succeeded.
• Confirmed the change updates src/views/LibraryView.tsx and that search UI still renders with highlight marks while snippet content is escaped.

---

Codex Task

[farce1]

Closing as superseded by #3, which takes the stronger approach: eliminates dangerouslySetInnerHTML entirely and uses non-HTML sentinel tokens rendered as React nodes (text + ) — no HTML ever enters the DOM pipeline, no regex-based sanitization to maintain. This PR's approach (escape + allowlist ) works but keeps dangerouslySetInnerHTML, which is a weaker security posture.