fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g.   for the space after a mention chip,
  or & for a typed "&") no longer render as literal " "/"&".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Makefile

@@ -25,7 +25,7 @@ test-contract:
 	$(GO) test -tags=contract -count=1 -timeout=8m ./internal/contract/
 
 lint:
-	@unformatted=$$(gofmt -l .); if [ -n "$$unformatted" ]; then \
+	@unformatted=$$(gofmt -l $$(git ls-files '*.go')); if [ -n "$$unformatted" ]; then \
 		echo "gofmt needed on:"; echo "$$unformatted"; exit 1; fi
 	$(GO) vet ./...