[security] replace innerHTML usages with DOMPurify and textContent

Co-authored-by: PR0M3TH3AN <[email protected]>

dashboard/app.js.diff

@@ -0,0 +1,11 @@
+--- dashboard/app.js
++++ dashboard/app.js
+@@ -321,7 +321,7 @@
+ function renderSummary(allLocks) {
+   summaryContainer.replaceChildren();
+   if (!isAlive()) return;
+-  summaryContainer.innerHTML = ''; // Clear fallback
++  summaryContainer.textContent = ''; // Clear fallback
+
+   const now = nowUnix();
+   let active = 0, expired = 0, completed = 0;