Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML

[GrimbiXcode]

Potential fix for https://github.com/GrimbiXcode/mtgscan/security/code-scanning/1

To fix the problem, escape any untrusted text content before inserting it into innerHTML. Specifically, for the notification system, instead of interpolating the user-provided message (which could contain HTML) directly into the notification's innerHTML, you should either:

1. Escape meta characters in the message string (convert <, >, &, ", ' etc. to their HTML entity equivalents), OR
2. Set the notification content using textContent instead of innerHTML for the message part.

The best approach in this context is to set .innerHTML only for safe, static markup (like the icon and structure), and inject the user-provided message as plain text using textContent.

This means:

• In showNotification, change the logic so that the notification container is constructed as a DOM structure with createElement, then set the icon via innerHTML (as it's from a hardcoded set), and set the message via textContent.
• Alternatively, if you need to keep using a template string, escape the message text before interpolation.

The edits are needed in showNotification (lines 2305-2309). If escaping is used, a small escapeHtml method will be required in the class.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.