security: enforce stricter input validation for #830

[basantnema31]

Resolves #830.

[SdSarthak]

The sanitizeInput utility is a one-liner regex that strips HTML tags but it's not wired to anything in the codebase — no forms, inputs, or API boundaries use it.

If this is meant to prevent XSS, the right approach is to use DOMPurify for sanitizing HTML content in the DocumentEditor preview (which renders raw markdown/HTML), not a regex on all inputs. Regex-based HTML stripping is not safe against all XSS vectors.

Please either:

1. Wire the validation to the components that actually need it (e.g., the document preview) with a proper sanitization library, or
2. Describe what specific vulnerability this fixes and where it's applied.