Adopt shared escapeHtml utility across codebase

## Summary
We centralized HTML escaping with a shared helper: `escapeHtml` in `js/utils.js`.

This follow-up issue tracks (a) sweeping the codebase to migrate local escape methods and risky templating to use the shared utility, and (b) announcing its availability to contributors after the PR merges.

## Why
- Consistent, safe escaping reduces XSS risk and eliminates duplicate implementations.
- One utility improves maintainability and developer ergonomics.

## Scope
- Replace local `escapeHtml` / `escapeHTML` implementations with `import { escapeHtml } from '/js/utils.js'`.
- Audit and update places building `innerHTML` or HTML attributes with dynamic values.

## Tasks
**Migration**
- [ ] Replace local `escapeHtml` / `escapeHTML` in components with the shared utility.
- [ ] Audit for direct template insertions of dynamic values and wrap with `escapeHtml` as needed.
- [ ] Review uses of `.innerHTML` and `setAttribute` with dynamic content.
- [ ] Grep patterns to review:
- `this.escapeHtml(|this.escapeHTML(|escapeHTML(`
- `.innerHTML =`
- `title="...${...}"` / `aria-label="...${...}"` with dynamic values
- `new DOMParser()` or stringified `outerHTML`

**Documentation**
- [ ] Update CONTRIBUTING.md or a DEVNOTES.md snippet: "Always use `escapeHtml` when inserting dynamic text into HTML or attributes."
- [ ] Add JSDoc to `js/utils.js` `escapeHtml` with usage examples.

**Communication (post-merge)**
- [ ] Announce the shared `escapeHtml` utility in the dev channel and encourage adoption in new code.
- [ ] Link to `js/utils.js`.

**Optional safeguards**
- [ ] Consider adding an ESLint rule or code review checklist item to flag raw `innerHTML` with dynamic inputs.

## Acceptance criteria
- No local escape helpers remain in source (excluding generated files under `_site/`).
- All audited dynamic insertions use `escapeHtml` where appropriate.