[BUG] SQText dashboard component uses v-html instead of v-dompurify-html

[AAtomical]

SQLBot Version
Latest (Docker image dataease/sqlbot)

Run Mode
Docker container

Describe the bug
sq-text/index.vue:19 renders TinyMCE output with v-html="configItem.propValue". The rest of the app uses v-dompurify-html (registered in main.ts:40), but this component bypasses it. Raw HTML stored in core_dashboard.component_data executes without sanitization.

To Reproduce

1. Log in and go to "仪表板"
2. Create a new dashboard, add an SQText component
3. Insert <img src=x onerror="alert(document.cookie)"> via TinyMCE source editor or API (POST /api/v1/dashboard/update_canvas)
4. Save and reopen the dashboard
5. JavaScript executes on load

Expected behavior
Event handler attributes (onerror, onload, etc.) should be stripped. The v-dompurify-html directive used elsewhere in the app handles this correctly.

Screenshots

Additional context

• CWE-79
• Currently limited to self-XSS (load_resource checks create_by == current_user.id). Becomes cross-user if dashboard sharing is added.
• Fix: replace v-html with v-dompurify-html on sq-text/index.vue:19.