fix(web): escape memory type badges

[GraDea]

Summary

Fixes the stored XSS vector reported in #135 for memoryType badge rendering.

memory.memoryType was interpolated directly into Web UI HTML in both standalone memory cards and combined prompt-memory cards. This PR reuses the existing escapeHtml() render-boundary helper so malicious memory type values render as text instead of executable markup.

Changes

• Escape memory.memoryType in renderMemoryCard()
• Escape memory.memoryType in renderCombinedCard()
• Add regression tests for both render paths using the confirmed <img onerror> payload

Verification

• bun test tests/web-memorytype-xss.test.ts
• bun test
• bun run typecheck
• bun run build

Scope

This PR intentionally only fixes the memoryType stored-XSS sink.

Other security concerns from #135, including auth/CORS hardening and broader prompt-injection behavior, should be handled in separate PRs.

[tickernelz]

You're the maintainer now, you can merge and release by yourself

[tickernelz]

LGTM ✅

Verification:

• escapeHtml() helper already exists in src/web/app.js:1130 and the implementation is correct (DOM textContent→innerHTML).
• Both sinks (renderCombinedCard line 186, renderMemoryCard line 284) now escape memory.memoryType.
• Test harness uses a node:vm Script sandbox with a real document.createElement mock — not just a string assertion.
• Local merge-test clean, bun test 156 pass, typecheck + build pass.

Scope:
This is correctly scoped — it only closes the XSS sink in memoryType. Memory content, tags, and displayName are already escaped via escapeHtml() / renderMarkdown() (DOMPurify-sanitized).

Nice catch on issue #135.

[tickernelz]

Merged ✅

Verification on merged main:

• Local merge-test clean (no conflicts with Fix Windows build and test suite compatibility #139)
• bun test → full suite pass (including both new web-memorytype-xss tests)
• bun run typecheck → pass
• bun run build → pass

Closes the stored-XSS sink in memoryType badge rendering reported in #135.