fix(dashboard): eliminate XSS via DOM-safe rendering

[SafetyMP]

Summary

• Replace innerHTML rendering with DOM APIs (textContent/createElement) for agents, tasks, approvals, events, and banners.
• Whitelist task states for KPI counts and badge CSS classes to close remote property injection.
• Sanitize WebSocket event type class names.

Test plan

• Open dashboard and verify agents/tasks/approvals render
• Submit task with <script> in title — must display as plain text
• CodeQL re-scan clears alerts chore(deps)(deps-dev): bump the types group with 2 updates #1–chore(ci)(deps): bump docker/metadata-action from 5 to 6 #3

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.