feat: Implement secure static file serving with path traversal protection and XSS prevention for template titles.

src/web/utils/html.test.ts

@@ -0,0 +1,17 @@
+
+import { describe, expect, it } from "bun:test";
+import { escapeHtml } from "./html";
+
+describe("HTML Utils", () => {
+    it("should escape special characters", () => {
+        const unsafe = '<script>alert("xss")</script>';
+        const safe = escapeHtml(unsafe);
+        expect(safe).toBe("&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;");
+    });
+
+    it("should handle mixed content", () => {
+        const unsafe = 'Hello & "World"';
+        const safe = escapeHtml(unsafe);
+        expect(safe).toBe("Hello &amp; &quot;World&quot;");
+    });
+});