fix: render frontend content with safe DOM APIs

[gordonmurray]

Closes #32

Summary

• replace frontend innerHTML assignments with replaceChildren, textContent, and explicit DOM construction
• preserve the existing health, vector badge, tooltip, empty-table, and status markup
• prevent dataset-controlled vector column names from being parsed as tooltip HTML
• add a regression test that prohibits innerHTML assignments in the frontend
• record the fix in the changelog

Testing

• node --check web/vanilla/app.js
• ../testing/run-tests.sh 0.36.0 — 65 passed
• built the canonical LanceDB 0.36.0 container
• smoke-tested /healthz, /, and the packaged /app.js

[gordonmurray]

The failed check is unrelated to this change. LanceDB 0.3.1, 0.3.4, and 0.5 have disappeared from PyPI, so the existing matrix can no longer install its legacy entries. The first failure cancelled the remaining jobs and skipped the build gate. Tracked separately in #92 with the workflow run and a recovery approach.

[gordonmurray]

Update: #93 repairs the legacy matrix, and its upstream run is fully green: all eight test jobs and all eight multi-architecture image builds passed, including LanceDB 0.3.4. Once #93 lands, this PR can be updated or rerun against the repaired workflow.

[gordonmurray]

Resolved: #93 is now on main, this branch has been updated, and the replacement CI run passes all 16 jobs (eight test variants and eight multi-architecture image builds).