fix(security): escape untrusted values in transactional email HTML

Customer input (first name, address, product names), order data, admin
fields (company data, carrier, tracking number) and URLs were inserted
into email HTML unescaped. A first name such as <a href="…">…</a> ended
up as a working link in a genuine shop email, usable for phishing.

All variable values in email HTML now go through escapeHtml
(lib/escape-html.ts, shared with the withdrawal receipt). Button links
only accept http(s), so a javascript: tracking URL is dropped. The plain
text part stays unescaped. Tests cover order confirmation, shipment,
status mails, layout company data and back-in-stock mails.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/app/api/widerruf/route.ts

@@ -5,7 +5,8 @@ import { rateLimit, getClientIp } from "@/lib/rate-limit";
 import { isTrustedOrigin } from "@/lib/csrf";
 import { sendMail } from "@/lib/mail";
 import { withdrawalReceiptEmail } from "@/lib/email-templates";
-import { escapeHtml, formatReceivedAt, withdrawalDeclarationLines } from "@/lib/withdrawal";
+import { formatReceivedAt, withdrawalDeclarationLines } from "@/lib/withdrawal";
+import { escapeHtml } from "@/lib/escape-html";
 import { getLocale } from "@/i18n/locale";
 
 const WITHDRAWALS_PER_WINDOW = 10;