fix(email): escape HTML on dynamic order and customer fields in emailService

[Pratyush-Panda-2006]

Description

Fixes HTML injection vulnerability in \�ackend/services/emailService.js. Previously, customer name, shipping address, product title, and item options were passed through \sanitizeString()\ (which only trimmed whitespace) rather than \escapeHTML(), allowing malicious HTML or script tags inside order confirmation email bodies.

Related Issue

Closes #1693

Clean Architecture & Changes

• Applied canonical \escapeHTML()\ sanitization to all dynamic fields before inserting into email templates and item rows.
• Included \html\ body in returned payload and exported \�uildItemsTableRows\ for testing.
• Added unit tests in \�ackend/tests/emailSanitization.test.js\ validating HTML tag escaping and protection against script injection.

Verification

• Run
  px jest tests/emailSanitization.test.js\ (All unit tests passing cleanly with 74%+ coverage).

[hydra-maintainer]

🔍 Quality Gate Report

✅ All quality gates passed!

Status	Check	Details
✅	Linked Issue	PR description references a closing issue ✅

[vercel]

@Pratyush-Panda-2006 is attempting to deploy a commit to the Bhuvansh's projects Team on Vercel.

A member of the Team first needs to authorize it.

[hydra-maintainer]

🤖 AI Code Review

🔴 Score: 50/100 | comment

AI review unavailable at this time.

---

Automated AI review — a human maintainer will also review.

[hydra-maintainer]

💡 Suggested reviewers based on relevant file history: @Aditya8369, @MOHITKOURAV01