security: sanitize HTML in popup trusted-origins list to prevent XSS

Replace innerHTML template literal interpolation with DOM API methods
(createElement, textContent, appendChild) when rendering the trusted
origins list. The previous code interpolated the origin string directly
into HTML, allowing an attacker who injects a malicious string into the
trusted origins (e.g. <img src=x onerror="...">) to execute arbitrary
JavaScript in the popup's privileged extension context, potentially
exfiltrating the user's private key.

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: DreamLab-AI Mega-Sprint

popup/popup.js

@@ -247,23 +247,28 @@ async function loadTrustedSites() {
     return;
   }
 
-  listEl.innerHTML = origins
-    .sort()
-    .map(origin => `
-      <div class="trusted-item">
-        <span class="trusted-origin">${origin}</span>
-        <button class="btn-remove" data-origin="${origin}">Remove</button>
-      </div>
-    `)
-    .join('');
-
-  // Add remove button handlers
-  listEl.querySelectorAll('.btn-remove').forEach(btn => {
+  listEl.innerHTML = '';
+  origins.sort().forEach(origin => {
+    const div = document.createElement('div');
+    div.className = 'trusted-item';
+
+    const span = document.createElement('span');
+    span.className = 'trusted-origin';
+    span.textContent = origin;
+
+    const btn = document.createElement('button');
+    btn.className = 'btn-remove';
+    btn.dataset.origin = origin;
+    btn.textContent = 'Remove';
+
     btn.addEventListener('click', async () => {
-      const origin = btn.dataset.origin;
       await removeTrustedSite(origin);
       await loadTrustedSites(); // Reload
     });
+
+    div.appendChild(span);
+    div.appendChild(btn);
+    listEl.appendChild(div);
   });
 }