[security] replace innerHTML usages in js/ui/subscriptionHistoryController.js

- Migrated 6 out of 7 innerHTML assignments to safe DOM APIs (createElement, textContent, replaceChildren).
- Reduced innerHTML baseline for the file from 7 to 1.
- Updated scripts/check-innerhtml.mjs baseline.
- Verified with lint, unit tests, and frontend verification.

Co-authored-by: PR0M3TH3AN <[email protected]>

scripts/check-innerhtml.mjs

@@ -48,7 +48,7 @@ const BASELINE = {
   "js/ui/loginModalController.js": 3,
   "js/ui/moreMenuController.js": 1,
   "js/ui/profileModalController.js": 1,
-  "js/ui/subscriptionHistoryController.js": 7,
+  "js/ui/subscriptionHistoryController.js": 1,
   "js/ui/videoListViewController.js": 1,
   "js/ui/views/VideoListView.js": 3,
   "js/utils/qrcode.js": 2,