fix(security): escape API-controlled values in sophia_dashboard innerHTML (RIP-306)

[xxzzzzy]

Summary

scripts/sophia_dashboard.py (Admin Dashboard for SophiaCore Attestation Inspector) renders 4 API-controlled innerHTML blocks. Three were missing escape, and one had the same unsafe inline-onclick+JSON.stringify pattern as #16790 (reviewer asked for that fix to be reused here).

Fix

• Add esc() helper that escapes & < > " ' and coerces nullish to ''.
• Replace per-row onclick='showDetail(${JSON.stringify(r).replace(/'/g,"'")})' with a single delegated click listener on #review-table that reads data-record-idx and looks up the record from currentFilteredRecords. The ' replace was a no-op (the browser HTML-decodes it back to ' before evaluating the JS string), and any value containing ' or </script> could break out.
• Escape every API-controlled value in tbody.innerHTML, detail-verdict, and detail-history.
• detail-title now uses textContent (inherently safe).
• Coerce confidences through Number() before arithmetic so a non-numeric payload returns NaN rather than NaN-as-string.
• Add EMOJI[...]-lookup fallback (|| '') so a malicious verdict value does not produce undefined in the chip.

Tests

tests/test_sophia_dashboard_xss.py — 9 source-pattern regression tests, all pass:

tests/test_sophia_dashboard_xss.py ........9 [100%]

Related

• Same defensive posture as fix(security): sandbox webview JS and validate openExternal URL (F-01, F-02) #16790, fix(security): prevent stored XSS via certId in bcos-badge-generator #16809–fix(security): escape API-controlled values in jonasxzb net-status page #16821.
• Companion to fix(security): implement real on-chain verification in elyan-staking-sdk (C-1) #16787–fix(security): sandbox model-supplied paths in implementer and make PR body honest #16789, fix(glassworm-protocol): fix env-var names, encode utf-8, declare permissions #16796 (admin/UI tier of the same fix series).

Notes

• Non-breaking hardening; all visual output preserved when the API returns well-formed values.
• No new dependencies, no workflow change, no API change.

[Scottcjn]

Escapes API-controlled values in sophia_dashboard innerHTML (RIP-306 surface).

[github-actions]

Sophia auto-tier: skipped — this PR touches consensus / money / CI code. It needs a maintainer Payment: N RTC directive rather than an automatic award.