Fix XSS fallback when DOMPurify is unavailable in chat markdown renderer.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/static/app.js

@@ -454,7 +454,7 @@ class TranscriptionApp {
         if (typeof DOMPurify !== 'undefined') {
             return DOMPurify.sanitize(html);
         }
-        return html;
+        return this.escapeHtml(text);
     }
 
     formatBytes(bytes) {