fix(app): replace custom HTML sanitizer with DOMPurify

Install dompurify and replace the hand-rolled DOM walker sanitizer
with DOMPurify.sanitize() configured with the same allowed tags.
Handles mutation XSS edge cases the custom version couldn't.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/package.json

@@ -33,7 +33,8 @@
     "plyr": "^3.8.4",
     "vue": "^3.5.29",
     "vue-router": "^5.0.3",
-    "wavesurfer.js": "^7.12.1"
+    "wavesurfer.js": "^7.12.1",
+    "dompurify": "^3.2.6"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",