security: client-side sanitize snapshot HTML (#110)

Defense-in-depth: run snapshot HTML through DOMPurify before injecting it via innerHTML in the viewer and embed, using the same allowlist the server-side SnapshotHtmlSanitizer enforces (formatting tags only, no attributes). .pad bodies are attacker-writable, so XSS now requires both the server and client gate to fail.

- src/lib/sanitize-html.js (sanitizeSnapshotHtml via DOMPurify), applied at both innerHTML sinks; embed derives its HTML path from the sanitized result.
- jsdom-pinned unit tests (happy-dom mis-sanitizes DOMPurify).
- deps: dompurify (runtime), jsdom (dev).

vitest 123 + full Playwright 23/23 on NC 33; CI green incl. stale-js guard.

Closes #110.

Author: Jaggob