fix(security): prevent stored XSS by escaping task titles, notes, and labels

[Vedhant26]

🔒 Fix: Prevent Stored XSS in Task Rendering

Closes #971

Hi @Charushi06! Here is the fix for the critical Stored XSS vulnerability.
Required Labels: bug, level 3, security, advanced.

Problem

Because the SQLite database is shared across all users (single-tenant), any user could create a task with malicious HTML or JavaScript in the title, notes, or labels (e.g., <script>alert('XSS')</script>).
When another user visited the dashboard, this script would execute in their browser context, potentially stealing their local storage or manipulating the app.

Solution

• Systematically applied the existing escapeHtml() utility to all user-controlled task fields when rendering DOM elements in js/app.js.
• This ensures that fields like task.title, task.notes, and task.labels are safely rendered as text, preventing any XSS payload execution.