feat(ui.client): add plans page with markdown rendering

- Add PlansPage component with DOMPurify-sanitized markdown rendering
- Add AbortController to prevent race conditions on fast switching
- Memoize marked.parse output
- Add key={env} to PlansPage for env-consistent remount
- Encode filename in API request to handle special chars
- Fix backend: fileURLToPath instead of import.meta.dirname
- Fix backend: try/catch on readdir, remove redundant stat calls
- Fix backend: block backslash path traversal

frontend/package.json

@@ -12,11 +12,13 @@
   },
   "dependencies": {
     "crypto-pro": "^2.3.0",
+    "dompurify": "^3.4.11",
+    "marked": "^12.0.0",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "marked": "^12.0.0"
+    "react-dom": "^19.0.0"
   },
   "devDependencies": {
+    "@types/dompurify": "^3.0.5",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^4.3.4",