Potential fix for code scanning alert no. 10: DOM text reinterpreted as HTML

[imbilawork]

Potential fix for https://github.com/2nth-ai/developers/security/code-scanning/10

In general, the fix is to avoid inserting raw, user-controlled text into innerHTML. Instead, build the DOM tree using document.createElement and assign user-provided values to textContent (or innerText) or to safe attributes. This preserves the intended UI while ensuring that any HTML meta-characters in the input are escaped and rendered as plain text, not executed as HTML/JS.

For this specific case in public/preview/luthuli/lodge.html, we should change the addTask function so that it no longer constructs the task item via a big HTML string assigned to div.innerHTML. Instead:

• Create the container div with class task (already done).
• Create a div for the priority indicator; set its className to 'task-pri pri-' + pri. If pri comes from a select with fixed options, this is safe; if not, ideally we would normalize or whitelist pri before using it in a class name, but we’ll limit ourselves to code shown.
• Create a div with class task-text, and inside it:
  • Create a strong element whose textContent is title.
  • If desc is present, append a text node ' — ' + desc (again via textContent/createTextNode).
• Create a div with class task-due and set its textContent to due || 'No date'.
• Append these elements to the task container div instead of setting innerHTML.

We should leave the addFeedItem function unchanged because, in the snippet, its inputs are either internal strings or controlled within code; the CodeQL alerts are specifically for the addTask path. All changes occur within the script tag of public/preview/luthuli/lodge.html, only around the addTask function, without introducing new imports or altering other behavior.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.