R2: Add escapeHtml to app.js for models/irs pages

src/web/static/app.js

@@ -5,6 +5,15 @@
  * and provides REST helper functions used by all pages.
  */
 
+/* ── XSS-safe string helper ───────────────────────────────────────── */
+
+function escapeHtml(text) {
+    if (text == null) return '';
+    const div = document.createElement('div');
+    div.appendChild(document.createTextNode(String(text)));
+    return div.innerHTML;
+}
+
 /* ── REST helpers ───────────────────────────────────────────────── */
 
 async function apiGet(path) {