fix: resolve CodeQL security-and-quality findings

[graydawnc]

Clears the open CodeQL code-scanning alerts. Each change is the high-confidence true positive; the lower-value/false-positive alerts (title tag-stripping, internal-only binary-name lookups) were left alone.

Changes

• redact (mask.ts) — internal-host mask now extracts the domain suffix with indexOf + a flat character-class check. The previous end-anchored, nested-quantifier regex backtracked quadratically on input like .-.-.-.-. Output is unchanged for real hostnames.
• core (spool-prelude.ts) — stripSpoolSystemPrelude scans with indexOf instead of /<open>[\s\S]*?<close>/g, which backtracked quadratically when many unterminated open markers appeared. Behavior is identical for normal input; an unterminated marker is left intact.
• app (snippet.ts) — search-snippet text is HTML-escaped before dangerouslySetInnerHTML, so only the <mark> highlight markers we inject become elements and indexed session content renders as inert text.
• share-kit (source.ts) — decodeEntities now decodes & last, so < resolves to the literal < instead of being double-unescaped to <. The stats CJK character class drops the redundant Hiragana/Katakana sub-ranges (they sit inside U+3000–U+9FFF), removing the overlap warning with no change to what matches.
• ci (e2e.yml) — added a minimal top-level permissions: contents: read block.
• e2e fixtures/spec — removed two no-op identity .replace() calls.

Tests

• Regression tests added for each logic change (snippet escaping, entity-decode order, CJK counting, internal-host masking + ReDoS timing guard, prelude stripping + ReDoS timing guard).
• Suites run green: redact (135), core (383), share-kit (43), app renderer unit incl. the new snippet test.