fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

- `app/templating.py` : `ENV = Environment(loader=FileSystemLoader("app/templates"), autoescape=select_autoescape(["html"]))`
- les 29 instantiations `Environment(loader=FileSystemLoader("app/templates"))` (9 routers) remplacées par `env = ENV` — plus aucune interpolation `{{ … }}` servie crue, les `|safe` redeviennent efficaces
- re-tri des `|safe` : `card_detail.html` corps d'issue et commentaires échappés (XSS stocké), placeholder de description sorti du ternaire, `sidebar_config` passé en dict + `|tojson` (échappement `</script>` en contexte script)
- `|safe` conservé sur `right_actions` (HTML fabriqué dans les templates, fiable)
- `ruff check app tests` OK · suite **1016/1016 verts**

app/routers/wiki.py

@@ -9,13 +9,13 @@ import html
 
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse
-from jinja2 import Environment, FileSystemLoader
 
 from app.auth.session import SessionManager
 from app.db import get_conn
 from app.services import wiki
 from app.services.api_v2_helpers import audit_log
 from app.services.notifications import create_notification
+from app.templating import ENV
 
 router = APIRouter(tags=["wiki"])
 
@@ -156,7 +156,7 @@ async def teamspace_page(teamspace_id: int, request: Request):
 .ts-row:hover{{background:var(--bg-hover);}}
 </style>"""
     from app.routers.dashboard import _sidebar_data
-    env = Environment(loader=FileSystemLoader("app/templates"))
+    env = ENV
     sidebar = _sidebar_data(request, [])
     block_tpl = env.from_string(
         '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'