v0.2.6 — Security fixes

v0.2.6 — Security fixes

Security

• DOM XSS fix: icon preview in host editor now uses createElement/textContent instead of innerHTML — prevents script injection via crafted icon URL
• Input validation: port validated as u16 (1–65535), invalid values fall back to 8849
• Input validation: host rejects dangerous characters, falls back to 0.0.0.0
• Input validation: web_refresh clamped to [5–3600] seconds
• Input validation: tab refresh normalized to positive integer or empty string

Code quality

• Fixed formatting in uptime monitor loop