fix(frontend+api): L-06+LOGIC -- evidence XSS and WS dedup

L-06: evidence chips in Components.FindingItem used e.substring(0,60)
without sanitize(). If evidence strings from scraped data contain angle
brackets, XSS was possible. sanitize() was used on description and
severity but missed the chips array.
Fix: wrapped substring with sanitize().

LOGIC (WS dedup): the WebSocket backend sent the same 8 records every
15 seconds when no new data was ingested. The frontend appended each
batch as new items. With no change detection, the feed filled with
100+ identical entries over time.
Fix: added last_scraped_at cursor on the server. When the most recent
scraped_at matches the previous send, the payload is skipped entirely.

api/main.py

@@ -162,6 +162,7 @@ async def websocket_feed(websocket: WebSocket):
     import asyncio
     await websocket.accept()
     logger.info("[WS] Feed client connected")
+    last_scraped_at = None   # WS cursor: only push when data changes
     try:
         while True:
             driver = get_driver()
@@ -178,6 +179,12 @@ async def websocket_feed(websocket: WebSocket):
                             "ORDER BY n.scraped_at DESC LIMIT 8",
                             labels=_FEED_LABELS
                         ).data()
+                        current_at = feed_rows[0].get("scraped_at") if feed_rows else None
+                        # LOGIC FIX: skip push if data has not changed since last send
+                        if current_at and current_at == last_scraped_at and feed_rows:
+                            await asyncio.sleep(15)
+                            continue
+                        last_scraped_at = current_at
                         if feed_rows:
                             payload["items"]   = feed_rows
                             payload["message"] = (