📝 Description

Fixes unsanitized innerHTML usage in the Budget Tracker, where user-supplied custom category and description values were interpolated directly into template strings without escaping — allowing arbitrary HTML/JS to execute in the browser (self-XSS), and persist across reloads via localStorage.
Added an escapeHTML() helper that converts a string into safe, literal text using the browser's own DOM serialization (via textContent → innerHTML round-trip). Applied it to the two places where user input reaches innerHTML:

renderTransactions() — escapes t.category and t.description
renderBreakdown() — escapes cat (the category name used in the breakdown label)

Note: populateCategories() (the categorySelect.innerHTML dropdown) was left unchanged — it's built only from the static BUDGET_CATEGORIES constant, not user input, so it wasn't actually affected by this vulnerability.
Tested: injecting the payload above into both the custom category field and the description field, confirmed no script execution in the transaction list or breakdown panel, and confirmed it stays inert after a page reload (localStorage round-trip).

🔗 Linked Issue

Closes #1583

📋 Contribution Checklist

• I have verified that my files are placed in the correct directory.
• I have tested my changes thoroughly on my local machine.
• GSSoC 2026: I have been formally assigned to this issue and noted it above.