fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g.   for the space after a mention chip,
  or & for a typed "&") no longer render as literal " "/"&".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -5,4 +5,4 @@ backups/
 coverage.out
 
 # Docker volume data (bind-mounted under the repo; never committed)
-/volumes/
+/.volumes/

Makefile

@@ -25,7 +25,7 @@ test-contract:
 	$(GO) test -tags=contract -count=1 -timeout=8m ./internal/contract/
 
 lint:
-	@unformatted=$$(gofmt -l .); if [ -n "$$unformatted" ]; then \
+	@unformatted=$$(gofmt -l $$(git ls-files '*.go')); if [ -n "$$unformatted" ]; then \
 		echo "gofmt needed on:"; echo "$$unformatted"; exit 1; fi
 	$(GO) vet ./...
 

docker-compose.yml

@@ -13,8 +13,8 @@ services:
     # Mongo is reachable only on the compose network; never published to the
     # host (§12).
     volumes:
-      # data lives in-repo (gitignored) so all state is under one tree
-      - ./volumes/mongo:/data/db
+      # data lives in-repo (gitignored, dot-prefixed so go tooling skips it)
+      - ./.volumes/mongo:/data/db
     healthcheck:
       test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
       interval: 10s
@@ -83,7 +83,7 @@ services:
     volumes:
       - ${HOME}/.claude:/home/node/.claude
       - ${HOME}/.claude.json:/home/node/.claude.json
-      - ./volumes/work:/work
+      - ./.volumes/work:/work
     ports:
       - "127.0.0.1:8091:8091"
     extra_hosts:

internal/chat/sanitize.go

@@ -31,10 +31,10 @@ func SanitizeHTML(in string) string {
 		if c != '<' {
 			j := strings.IndexByte(in[i:], '<')
 			if j < 0 {
-				out.WriteString(html.EscapeString(in[i:]))
+				out.WriteString(escapeText(in[i:]))
 				break
 			}
-			out.WriteString(html.EscapeString(in[i : i+j]))
+			out.WriteString(escapeText(in[i : i+j]))
 			i += j
 			continue
 		}
@@ -118,6 +118,15 @@ func SanitizeHTML(in string) string {
 	return out.String()
 }
 
+// escapeText normalizes a text run from (possibly entity-encoded) input HTML:
+// decode existing entities, then re-escape. This keeps a single round of
+// escaping so entities the browser emits — e.g. &nbsp; for spaces around inline
+// elements, or &amp; for a typed "&" — don't get double-escaped into visible
+// "&nbsp;"/"&amp;" text. Re-escaping keeps the output XSS-safe.
+func escapeText(s string) string {
+	return html.EscapeString(html.UnescapeString(s))
+}
+
 // splitTag separates the tag name from its raw attribute string.
 func splitTag(raw string) (string, string) {
 	for i := 0; i < len(raw); i++ {
@@ -219,10 +228,10 @@ func SanitizePlain(in string) string {
 		if in[i] != '<' {
 			j := strings.IndexByte(in[i:], '<')
 			if j < 0 {
-				out.WriteString(html.EscapeString(in[i:]))
+				out.WriteString(escapeText(in[i:]))
 				break
 			}
-			out.WriteString(html.EscapeString(in[i : i+j]))
+			out.WriteString(escapeText(in[i : i+j]))
 			i += j
 			continue
 		}

internal/chat/sanitize_test.go

@@ -12,6 +12,10 @@ func TestSanitizeHTML(t *testing.T) {
 		want string
 	}{
 		{"plain text escaped", `hello <world> & "friends"`, "hello  &amp; &#34;friends&#34;"},
+		{"existing entity not double-escaped", `a &amp; b &lt;ok&gt;`, "a &amp; b &lt;ok&gt;"},
+		{"mention span kept with sanitized uid", `<span class="mention" data-user-card="01ABCdef">@Jane Doe</span> hi`,
+			`<span class="mention" data-user-card="01ABCdef">@Jane Doe</span> hi`},
+		{"non-mention span dropped", `<span style="x">keep text</span>`, "keep text"},
 		{"allowed formatting kept", "<b>bold</b> <i>it</i> <u>u</u> <s>s</s>", "<b>bold</b> <i>it</i> <u>u</u> <s>s</s>"},
 		{"paragraph and lists", "<p>a</p><ul><li>x</li><li>y</li></ul>", "<p>a</p><ul><li>x</li><li>y</li></ul>"},
 		{"code and pre", "<pre><code>x := 1</code></pre>", "<pre><code>x := 1</code></pre>"},