security: sanitize episode HTML with DOMPurify (XSS)

Episode descriptions came from third-party RSS feeds and were rendered
via dangerouslySetInnerHTML without sanitization. Wrap with DOMPurify
using a whitelist of safe tags/attrs and an http(s)/mailto-only URI
regex.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

frontend/package.json

@@ -17,12 +17,14 @@
     "@tanstack/react-query": "^5.1.0",
     "zustand": "^4.4.1",
     "@heroicons/react": "^2.0.18",
-    "axios": "^1.5.0",
-    "lucide-react": "^0.292.0"
+    "axios": "^1.7.9",
+    "lucide-react": "^0.292.0",
+    "dompurify": "^3.2.3"
   },
   "devDependencies": {
     "@types/react": "^18.2.28",
     "@types/react-dom": "^18.2.13",
+    "@types/dompurify": "^3.2.0",
     "@vitejs/plugin-react": "^4.1.0",
     "autoprefixer": "^10.4.16",
     "eslint": "^9.18.0",