Merge pull request #2455 from PR0M3TH3AN/ai/innerhtml-fix/subscriptions-12650247027422970359

[security] replace innerHTML usages in js/subscriptions.js — convert to safe DOM APIs

test_logs/TEST_LOG_2026-02-13_subscriptions.md

@@ -0,0 +1,17 @@
+# Test Log
+
+- **Date:** 2026-02-13
+- **File:** `js/subscriptions.js`
+
+## Commands
+
+### Lint
+`npm run lint` -> Passed (after `npm ci`).
+
+### innerHTML Audit
+`node scripts/check-innerhtml.mjs --report` -> `js/subscriptions.js` removed from list (count 0).
+
+## Verification
+- Replaced 7 assignments of `innerHTML` with `_renderStatusMessage` and `_renderLoading`.
+- These helpers use `replaceChildren()` and `document.createElement()`.
+- Verified that `getSidebarLoadingMarkup` dependency was removed from the file.