v2.19.2

Security patch.

Fixed

• XSS hardening at DOM sinks — every interpolated value was already escaped and markdown went through DOMPurify, but the innerHTML sinks themselves had no recognized barrier. Both (#app and the modal root) now run through DOMPurify.sanitize, closing CodeQL alert #9 and adding defense-in-depth for any future unescaped interpolation. Degrades to the raw string when DOMPurify hasn't loaded (e.g. the DOM-less smoke harness).

Full Changelog: v2.19.1...v2.19.2