fix: prevent XSS in addChatMessage by using textContent for user input

- Escape sender name via escapeHtml in innerHTML template
- Set message content via textContent instead of innerHTML injection
- Prevents HTML/script injection from user input or LLM responses

bot/static/index.html

@@ -5024,12 +5024,15 @@ function addChatMessage(sender, content, isError = false) {
   
   messageDiv.innerHTML = `
     <div class="chat-message-header">
-      <span class="chat-message-sender">${sender}</span>
+      <span class="chat-message-sender">${escapeHtml(sender)}</span>
       <span class="chat-message-time">${timestamp}</span>
     </div>
-    <div class="chat-message-content">${content}</div>
+    <div class="chat-message-content"></div>
   `;
   
+  // Set content via textContent to prevent XSS
+  messageDiv.querySelector('.chat-message-content').textContent = content;
+  
   chatMessages.appendChild(messageDiv);
   
   // Scroll to bottom