fix(webui): prevent agent HTML/CSS from polluting the main UI

[ktz03]

Summary

• Stop agent-generated <style> / stylesheet <link> from being injected into the app document via SafeMarkdown (rehypeRaw).
• Sanitize SVG report HTML with DOMPurify (forbid style/link/script).
• Full HTML reports already render in a sandboxed iframe; this closes the markdown/raw-HTML path that was leaking CSS into the shell.

Fixes #242

Testing plan

• Render a normal markdown assistant message (unchanged).
• Stream/generate HTML containing <style>body{display:none}</style> in a chat message and confirm the main UI is not restyled.
• Open an HTML report message and confirm iframe preview still works.
• Open an SVG report and confirm it still renders without injecting page-level CSS.