chore: guard unsafe DOM HTML with ESLint #18

Enable no-unsanitized recommended rules and verify TypeScript DOM sink diagnostics.

scripts/test-eslint.mjs

@@ -5,6 +5,7 @@ import vitest from "@vitest/eslint-plugin";
 import { ESLint } from "eslint";
 import { importX } from "eslint-plugin-import-x";
 import jestDom from "eslint-plugin-jest-dom";
+import noUnsanitized from "eslint-plugin-no-unsanitized";
 import perfectionist from "eslint-plugin-perfectionist";
 import hooks from "eslint-plugin-react-hooks";
 import refresh from "eslint-plugin-react-refresh";
@@ -71,6 +72,16 @@ test("ESLint enforces the frontend profile and excludes generated artifacts", as
 			"import { exec } from \"node:child_process\"; exec(process.argv[2]);",
 			"security/detect-child-process",
 		],
+		[
+			"src/shared/api/problem-details.ts",
+			"export function renderHtml(element: HTMLElement, html: string) { element.innerHTML = html; }",
+			"no-unsanitized/property",
+		],
+		[
+			"src/shared/api/problem-details.ts",
+			"export function renderHtml(element: HTMLElement, html: string) { element.insertAdjacentHTML(\"beforeend\", html); }",
+			"no-unsanitized/method",
+		],
 		[
 			"packages/ui/src/EntryCard/EntryCard.test.tsx",
 			"import { expect } from \"vitest\"; expect(document.activeElement).toBe(document.body);",
@@ -126,6 +137,7 @@ test("all recommended plugin rules remain enabled in their intended scopes", asy
 		[sonarjs.configs.recommended, source],
 		[regexp.configs.recommended, source],
 		[security.configs.recommended, source],
+		[noUnsanitized.configs.recommended, source],
 		[perfectionist.configs["recommended-natural"], source],
 		[stylistic.configs.recommended, component],
 		[react.configs["recommended-type-checked"], component],