fix: escHtml для всех innerHTML (XSS)

site/static/app.js

@@ -203,7 +203,7 @@ async function runClassify() {
     if (!classifyDone) {
       clearInterval(timer);
       clearInterval(pollTimer);
-      btn.innerHTML = '✗ ' + e.message;
+      btn.innerHTML = '✗ ' + escHtml(e.message);
       btn.disabled = false;
     }
   }
@@ -291,7 +291,7 @@ window.runCompareForGroup = async function(gi, btn) {
         state._activeCompare.timer = null;
         state._activeCompare.es = null;
         group.compare = null;
-        cmpBody.innerHTML += '<div style="color:var(--destructive);">✗ ' + d.message + '</div>';
+        cmpBody.innerHTML += '<div style="color:var(--destructive);">✗ ' + escHtml(d.message) + '</div>';
         btn.innerHTML = '✗'; btn.disabled = false;
         document.querySelectorAll('.cmp-btn').forEach(function(b) { b.disabled = false; });
       },
@@ -340,7 +340,7 @@ document.getElementById('llmBtn').addEventListener('click', function() {
       lucide.createIcons();
     },
     onError: function(d) {
-      compareBody.innerHTML += '<div style="color:var(--destructive);margin-top:8px;">✗ ' + d.message + '</div>';
+      compareBody.innerHTML += '<div style="color:var(--destructive);margin-top:8px;">✗ ' + escHtml(d.message) + '</div>';
       btn.innerHTML = '<i data-lucide="scale" style="width:16px;height:16px;"></i> Общее сравнение';
       btn.disabled = false;
     },