Reconsider XSS escaping before saving in the DB

Currently it leads to things like this in the GUI `I haven't even started`.

The following article also makes good points, in particular that every data receiver requires different kind of escaping (HTML, JS, Shell, ...) so it should be responsibility of that receiver to do it. I assume (but need to test!) that React does this correctly, therefore making escaping the HTML before storing in the DB unnecessary.

https://lukeplant.me.uk/blog/posts/why-escape-on-input-is-a-bad-idea/

Start by reproducing the GUI output and tracing where the value is escaped before database storage and where it is rendered by React. Review the linked article and verify the behavior for each receiver involved. Done means the escaping responsibility is decided, the double-escaped display is addressed, and relevant persistence and rendering cases are covered.

Written by the indexing model from the issue text.