fix(gui/security): escape filterFormatters.software to close newline-bypass XSS in /relays

Mirror the encode-on-output mitigation shipped in PR #900 for
tableFormatters.software (commit 5f3aff4) — wrap the formatter return
in escapeHtml so the same neutralization applies on the filter render
path at DataViewFilters.svelte:748.

The space-only guard in makeSoftwareReadable() rejects literal spaces
but lets newlines pass, so the payload <img\nsrc=x\nonerror=...>
defeated the guard and reached the {@html} sink. After this change the
structural HTML metacharacters are entity-encoded so no DOM is built
and no event handler can fire.

Also tightens the regression test: structural-escape assertions
(no raw <, >, or ") replace the unsatisfiable substring check on
'onerror=' (which appears as inert identifier text in the escaped
output — neutralized but not stripped).

Out of scope (separate concern flagged by reporter): cache versioning
/ aggregate:complete IndexedDB+localStorage purge on deploy. Already-
poisoned browser state may continue executing on reloads until fresh
data overwrites it.

Author: dskvr

apps/gui/src/lib/config/dataTable/relays.formatters.test.ts

@@ -171,11 +171,22 @@ describe('XSS regression: relay filter formatters', () => {
         // spaces but lets newlines through. Without escapeHtml, the
         // payload reaches {@html} in DataViewFilters.svelte and the img
         // onerror fires even when the filter pane is display:none.
+        // After the fix, the structural HTML metacharacters are entity-
+        // encoded, so no <img> element is constructed and the surrounding
+        // attribute-quote `"` is escaped to &quot; — onerror= survives as
+        // inert text inside the escaped string but cannot fire because
+        // there is no parsed element to attach it to.
         const NEWLINE_BYPASS = `<img\nsrc=x\nonerror=location.href="https://attacker.example">`;
         const out = relayFilterFormatters.software(NEWLINE_BYPASS);
+        // Structural metacharacters MUST be escaped so no DOM is built.
         expect(out).not.toContain('<img');
-        expect(out).not.toContain('onerror=');
+        expect(out).not.toContain('<');
+        expect(out).not.toContain('>');
+        expect(out).not.toContain('"');
+        // And the canonical escape markers MUST be present.
         expect(out).toContain('&lt;img');
+        expect(out).toContain('&quot;');
+        expect(out).toContain('&gt;');
     });
 
     it('software filter formatter escapes a script-tag payload', () => {

apps/gui/src/lib/config/dataTable/relays.ts

@@ -565,7 +565,7 @@ export const filterFormatters: Formatters = {
     },
     software: (software) => {
         if(typeof software !== 'string') return '-';
-        return makeSoftwareReadable(software);
+        return escapeHtml(makeSoftwareReadable(software));
     },
     operatorPubkey: (pk: string): string => {
         if(!pk) return ' ';