feat: normalize numeric formatting & add time-range selector for usage trends (sanitization fix)

[Fail-Safe]

Address security/code-scanning/9: Sanitize dynamic HTML content in the webview and avoid unsanitized innerHTML to reduce DOM XSS risk. Also fixed linter issues in src/lib/usageHistory.ts (removed unused async/unused params).\n\nChanges include:\n- Added escapeHtml() helper in media/webview.js and used it when interpolating user-controlled or extension-provided strings into innerHTML templates (insights, anomalies, included limit text, metrics).\n- Replaced some innerHTML usage with DOM-safe textContent where applicable.\n- Fixed linter warnings in src/lib/usageHistory.ts and removed unnecessary async/await in archiveOldData to avoid require-await ESLint rule.\n\nValidation:\n- npm run lint passes.\n- npm test all suites pass (53 tests).\n\nNotes:\n- This partially addresses CodeQL findings by escaping values before adding them to HTML. If you prefer, we can take a more defensive route and replace templates with DOM construction entirely (safer but larger diff).\n- If you’d like me to further harden webview templates, I can convert the remaining innerHTML blocks to DOM assumptions using createElement + textContent instead of HTML templates.\n

To fix the DOM-based XSS vulnerability, all instances where untrusted data is inserted into HTML must be properly escaped before being included in HTML strings set via innerHTML. In this case, the affected code is in the renderMultiMonthAnalysis function, especially where values from the analysis object (ultimately from event.data) are interpolated into the html string.

The safest and least intrusive fix is to create a reusable HTML-escaping function, such as escapeHtml, and apply it to any untrusted values inserted into the HTML string. This method leaves all layout and logic unchanged, only ensuring that inserted content cannot break HTML context or inject scripts. The escapeHtml function can be added near the top of the module, or immediately before its first use.

Approach

• Add a helper function (e.g., escapeHtml(str)) that escapes <, >, &, ", ', and `.
• In renderMultiMonthAnalysis, wrap all instances of analysis.dataMonths (and any other untrusted values) inside escapeHtml(String(...)) when interpolating into the HTML string.
• (If there are other places where untrusted data is injected into HTML in this block, escape those as well; focus on what is shown in the snippet.)
• No changes needed to dependencies—basic escaping can be accomplished with a simple utility.

---