fix: escape verifier HTML fields

[mikemikimike]

Summary / Problem

The /verify/page endpoint interpolated receipt fields directly into HTML. A valid receipt containing HTML in its query or answer could therefore produce active markup, including script or event-handler elements, in the verification page.

Changes

• Escape receipt metadata, query, answer, signer, Merkle root, and verification check text before inserting them into the HTML page.
• Add an API regression test using a valid signed receipt with script and event-handler markup, asserting that the response contains escaped entities and no raw tags.

Tests

• PowerShell $env:PYTHONUTF8='1'; .venv/Scripts/python.exe -m pytest -q --basetemp .pytest-tmp (86 passed, Python 3.12)
• PowerShell $env:PYTHONUTF8='1'; .venv311/Scripts/python.exe -m pytest -q --basetemp .pytest-tmp311 (86 passed, Python 3.11)
• .venv/Scripts/pytest.exe -q --basetemp .pytest-tmp tests/test_api.py::test_verify_page_escapes_receipt_fields (1 passed)
• .venv/Scripts/ruff.exe check .
• python examples/demo_rag.py
• .venv/Scripts/python.exe -m compileall -q src tests
• uv build --out-dir .build-artifacts
• git diff --check

Compatibility / Known limitations

Receipt signing, canonical serialization, verification results, and the JSON /verify endpoint are unchanged. Only the HTML representation escapes dynamic text before rendering. The local Windows environment requires UTF-8 mode for the repository's UTF-8 README fixture; CI runs on Linux.

Issue link

Closes #11