Micro-perf polish: cached sanitizer, single-pass escape_html, clamp

Three small wins bundled because they're all one-file drive-bys:

1. render_markdown: cache ammonia::Builder and pulldown_cmark Options
   in a OnceLock so the config isn't re-constructed on every render.
   High-traffic dashboard / memo pages re-render constantly, and the
   Builder's allowed-tag and allowed-attribute sets add up.

2. escape_html: collapse the five chained .replace() passes (each of
   which allocates a fresh String) into a single scan that pushes the
   entity references into one pre-allocated buffer. Extract it to the
   shared markdown module so the duplicate copy in
   services::comparison can drop.

3. Replace .min(10.0).max(0.0) with .clamp(0.0, 10.0) in the score
   pipelines. Same semantics, slightly cheaper, and Clippy-approved.

Added unit tests for the shared escape_html and render_markdown
sanitization pass.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: morganlinton

src/markdown.rs

@@ -1,14 +1,76 @@
+use ammonia::Builder;
 use pulldown_cmark::{html, Options, Parser};
+use std::sync::OnceLock;
 
-pub fn render_markdown(markdown: &str) -> String {
-    let mut options = Options::empty();
-    options.insert(Options::ENABLE_STRIKETHROUGH);
-    options.insert(Options::ENABLE_TABLES);
-    options.insert(Options::ENABLE_TASKLISTS);
-    options.insert(Options::ENABLE_FOOTNOTES);
+/// Pre-configured ammonia sanitizer + pulldown-cmark option set. Cached in
+/// a `OnceLock` so every render reuses the same configured `Builder` rather
+/// than rebuilding the allowed-tag and allowed-attribute sets on each call.
+static SANITIZER: OnceLock<Builder<'static>> = OnceLock::new();
+static MARKDOWN_OPTIONS: OnceLock<Options> = OnceLock::new();
+
+fn sanitizer() -> &'static Builder<'static> {
+    SANITIZER.get_or_init(Builder::default)
+}
 
-    let parser = Parser::new_ext(markdown, options);
+fn markdown_options() -> Options {
+    *MARKDOWN_OPTIONS.get_or_init(|| {
+        let mut options = Options::empty();
+        options.insert(Options::ENABLE_STRIKETHROUGH);
+        options.insert(Options::ENABLE_TABLES);
+        options.insert(Options::ENABLE_TASKLISTS);
+        options.insert(Options::ENABLE_FOOTNOTES);
+        options
+    })
+}
+
+pub fn render_markdown(markdown: &str) -> String {
+    let parser = Parser::new_ext(markdown, markdown_options());
     let mut html_output = String::new();
     html::push_html(&mut html_output, parser);
-    ammonia::clean(&html_output)
+    sanitizer().clean(&html_output).to_string()
+}
+
+/// Escape a string for safe insertion into HTML text / attribute context.
+/// Single-pass, allocates once with a best-effort capacity estimate. Mirrors
+/// the old five-chained-`.replace()` behaviour but avoids building four
+/// throw-away intermediate strings per call.
+pub fn escape_html(raw: &str) -> String {
+    let mut out = String::with_capacity(raw.len());
+    for c in raw.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&#39;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn escape_html_replaces_specials() {
+        assert_eq!(
+            escape_html("<a href=\"x\">O'Reilly & Sons</a>"),
+            "&lt;a href=&quot;x&quot;&gt;O&#39;Reilly &amp; Sons&lt;/a&gt;"
+        );
+    }
+
+    #[test]
+    fn escape_html_passes_through_plain_text() {
+        let s = "Hello, world!";
+        assert_eq!(escape_html(s), s);
+    }
+
+    #[test]
+    fn render_markdown_sanitizes_script_tags() {
+        let raw = "Hello <script>alert('x')</script> world";
+        let out = render_markdown(raw);
+        assert!(!out.contains("<script"), "rendered output: {out}");
+    }
 }

src/services/comparison.rs

@@ -1,4 +1,7 @@
-use crate::{app_state::AppState, models::ComparisonRunWithDetails, status::RunStatus};
+use crate::{
+    app_state::AppState, markdown::escape_html, models::ComparisonRunWithDetails,
+    status::RunStatus,
+};
 use anyhow::Result;
 
 pub async fn sync_comparisons_for_run(state: &AppState, run_id: &str) -> Result<()> {
@@ -134,10 +137,4 @@ fn build_terminal_rollup(
     (status, summary, final_html)
 }
 
-fn escape_html(raw: &str) -> String {
-    raw.replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-        .replace('"', "&quot;")
-        .replace('\'', "&#39;")
-}
+

src/services/opportunity_ranker.rs

@@ -43,7 +43,7 @@ pub fn calculate_overall_score(
         + (coverage_gap * 0.25)
         + (timing * 0.20);
 
-    weighted_score.min(10.0).max(0.0)
+    weighted_score.clamp(0.0, 10.0)
 }
 
 /// Rank opportunities by overall score.

src/services/signal_detector.rs

@@ -96,7 +96,7 @@ pub fn calculate_signal_strength(signals: &[ScanSignal]) -> f64 {
         .sum();
 
     let avg_weight = total_weight / signals.len() as f64;
-    (avg_weight * 10.0).min(10.0).max(0.0)
+    (avg_weight * 10.0).clamp(0.0, 10.0)
 }
 
 /// Calculate timing score based on signal freshness.