fix(dashboard): eliminate XSS via DOM-safe rendering (#23)

Replace innerHTML rendering of API data with createElement/textContent,
whitelist task states for KPI aggregation and CSS classes, and sanitize
event type class names to close CodeQL alerts #1-#3.

Co-authored-by: Sage Hart <sagehart@MacBookAir.attlocal.net>

Author: SafetyMP