[Security]: mermaid SVG output is injected into HTML without sanitization (XSS via label HTML in loose mode)

Summary: Mermaid renders with `securityLevel: 'loose'`, which allows raw HTML inside diagram labels to survive rendering. MermaidBlock injects the rendered SVG straight into the DOM via `dangerouslySetInnerHTML` without sanitization, so a crafted diagram can execute script, abuse `on*` handlers, or navigate via `javascript:` URLs in the renderer context.

Area: Web UI

Reproduction or evidence: `src/web-ui/src/component-library/components/Markdown/MermaidBlock.tsx:209` assigns `svgContent` (produced by `MermaidService.renderDiagram`, cache path :59/:95) directly to `dangerouslySetInnerHTML`; no sanitization exists anywhere in the render chain. With `securityLevel: 'loose'`, a mermaid diagram containing `` / `` / `javascript:` href inside a label yields executable markup in the DOM.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), mermaid ^11.10.1.

Start with src/web-ui/src/component-library/components/Markdown/MermaidBlock.tsx, especially lines 59, 95, and 209, then trace MermaidService.renderDiagram and the svgContent cache path. Reproduce with the supplied HTML, script, event-handler, and javascript: label examples. Done means crafted loose-mode labels no longer execute when rendered while normal Mermaid SVG output still works.

Written by the indexing model from the issue text.