Close four disclosure and injection paths (review, area 1a)

[adamjohnwright]

These four come from the max-level code review of src/api and src/handoff. The reviewer confirmed each one by running code, and I checked each again before fixing it.

Finding	Fix	Test
A search question handed off to the chat was rendered unescaped, and the chat renders HTML (unsafe_allow_html, rehype-raw). A shared Continue-in-chat link therefore put live markup into whoever opened it, including script inside a srcdoc iframe running in the chat's origin.	escape(handoff.question)	Unit test. Also checked in a browser: with the fix, 0 live elements and the markup shown as text; with the escape removed, 1 live element.
httpx logs request URLs at INFO, and Analysis Service URLs carry the reader's analysis token, a bearer capability for the full result.	httpx and httpcore log at WARNING	Unit test, sabotaged
The gene-list result seeded into the model's history kept the Pathway Browser link, which contains the token.	Overrepresentation.for_model drops the link	Unit test, sabotaged
A thread seeded with a reader's analysis still ran the web search (Tavily), whose query is rephrased from that history.	Web search is off on such threads	Not unit-tested: it's in the Chainlit handler, which the tests don't import. It changes one boolean.

The browser check is ~/chat-uitest/handoff_markup.py.

The other 11 findings from area 1a will follow in separate PRs.

🤖 Generated with Claude Code