Fix planner map preview rendering and escape generated content

[ercmine]

Motivation

• The planner page did not show a map preview for generated itineraries and injected raw itinerary fields into innerHTML, which risked unsafe rendering and poor UX.
• The intention is to surface a quick map preview alongside generated stops and to harden the result rendering against unsafe content.

Description

• Added an escapeHtml helper to sanitize itinerary title, summary, and stop fields before injecting into innerHTML.
• Added buildMapSrc which constructs a Google Maps embed query from up to 5 stop addresses/place titles plus city context and returns an embed src URL.
• Render the map preview iframe inline in the planner result markup when buildMapSrc returns a non-empty URL, instead of relying on pre-existing hidden DOM nodes.
• Changes are contained to web/src/pages/planner.astro and ensure the planner result block includes the sanitized itinerary and optional map iframe.

Testing

• Ran pnpm --dir web build; the planner page changes compiled successfully but the full build fails due to a pre-existing unrelated SSR error (window is not defined in src/pages/marketplace.astro).
• Confirmed the modified planner.astro renders sanitized HTML with the constructed src included in the iframe markup when itinerary data is present.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.