[SECURITY] Fix XSS sanitization gaps in DeviceCard — closes #8

[spektre-labs]

Summary

Fixes #8 — DOM XSS sanitization for device meter labels.

Changes:

• Extract sanitize() and validateLabel() to src/utils/sanitize.ts (shared, testable)
• Update DeviceCard.tsx to import from the shared utility
• Apply sanitize() to metrics values (previously unsanitized — String(value) was passed raw)
• Add 14 unit tests in tests/unit/sanitize.test.ts covering all XSS vectors from the issue

Security impact

Before this fix, the metrics record values were rendered via {String(value)} without sanitization. While React's JSX escaping prevents direct script injection, applying sanitize() provides defense-in-depth against:

• <script> / <img onerror=> payloads
• javascript: URI schemes
• on*= event handler injections

All three entry points (label, location, metrics.key, metrics.value) are now sanitized.

Test coverage

sanitize()
  ✓ strips < and > characters
  ✓ removes javascript: URI scheme (case-insensitive)
  ✓ strips onerror= and other on* event handlers
  ✓ leaves safe strings unchanged
  ✓ handles empty string
  ✓ handles combined payloads
  ✓ removes javascript: even when embedded in larger string

validateLabel()
  ✓ truncates to 64 characters
  ✓ leaves short labels unchanged
  ✓ sanitizes before truncating
  ✓ returns empty string for pure XSS label

Checklist

• No external dependencies added (pure function, regex-based)
• Returns "" for dangerous-only inputs
• Truncation to 64 chars applied in validateLabel
• useMemo used for safeLabel and safeLocation
• Tests follow vitest config pattern (tests/**/*.test.ts)

[elizabetheonoja-art]

LGTM