fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g.   for the space after a mention chip,
  or & for a typed "&") no longer render as literal " "/"&".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -13,8 +13,8 @@ services:
     # Mongo is reachable only on the compose network; never published to the
     # host (§12).
     volumes:
-      # data lives in-repo (gitignored) so all state is under one tree
-      - ./volumes/mongo:/data/db
+      # data lives in-repo (gitignored, dot-prefixed so go tooling skips it)
+      - ./.volumes/mongo:/data/db
     healthcheck:
       test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
       interval: 10s
@@ -83,7 +83,7 @@ services:
     volumes:
       - ${HOME}/.claude:/home/node/.claude
       - ${HOME}/.claude.json:/home/node/.claude.json
-      - ./volumes/work:/work
+      - ./.volumes/work:/work
     ports:
       - "127.0.0.1:8091:8091"
     extra_hosts: