Target names, URLs and log lines reach the page as text (closes #29)

A host row escapes the name and URL it writes into its markup with a new
escapeHTML function, and the debug log builds each line as an element
whose text is set, so neither is read as HTML once targets can be
configured. A unit test builds the row of a target named <b>x</b>;
hostRowHTML is exported for it.

README.md stops calling CONFIG frozen: the interval menu changes
updateInterval. AppState declares _recoveryProbeId and
_recoveryProbeChecks, the sparkline axis functions drop the parameters
they never used, and HostState's history comment names both entry
shapes.

Model: opus-5-5

README.md

@@ -99,8 +99,9 @@ files are served, with no backend required.
 The application is a single-page app built with Vite and Tailwind CSS v4. All
 code lives in `src/main.js` with a class-based architecture:
 
-- **`CONFIG`**: Frozen configuration object (update interval, timeouts, axis
-  ticks, etc.)
+- **`CONFIG`**: Configuration object (update interval, timeouts, axis ticks,
+  etc.). `updateInterval` is the one value in it that changes while the page
+  runs: the interval menu sets it
 - **`HostState`**: Per-host state management — history buffer, latency tracking,
   status transitions
 - **`AppState`**: Top-level state container — WAN hosts, local hosts, pause