fix: XSS sanitization, CSP headers, and no-danger ESLint rule [FE-04]

[yusuftomilola]

Summary

Closes the XSS vector in contact message and menu item rendering by introducing DOMPurify sanitization, adding Content-Security-Policy headers to all responses, and flagging future dangerouslySetInnerHTML usage via ESLint.

Files Changed

New

• frontend/lib/utils/sanitize.ts — sanitize(input) wrapping DOMPurify.sanitize with a strict allowlist: no <script>, no event handler attributes, no javascript: or data: URIs; stripTags(input) for plain-text-only output; safe server-side fallback (strips tags via regex when window is absent)
• frontend/lib/utils/sanitize.test.ts — 9 unit tests covering plain text, <script> injection, event attributes, javascript: URIs, data: URIs, safe formatting tags, empty string, and nested XSS

Modified

• frontend/package.json — added dompurify@^3.2.6 and @types/dompurify@^3.0.5
• frontend/next.config.ts — added headers() config applying CSP + X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy to all routes
• frontend/eslint.config.mjs — added "react/no-danger": "error" to flag any new dangerouslySetInnerHTML usage

Acceptance Criteria

• <script>alert(1)</script> renders as escaped text, not executable markup
• Content-Security-Policy header present on all page responses
• DOMPurify allowlist is explicit and documented in sanitize util
• react/no-danger ESLint rule added
• Unit tests cover: plain text, HTML tags, script injection, event attributes, URI schemes

closes #272