docs: README dompurify note; fix: sanitize plaintext names in booking emails; feat: use sanitizePhone in email templates; feat: extend sanitizeHtml allowed tags and URL allowlist

package.json

@@ -12,6 +12,8 @@
     "preview": "vite preview"
   },
   "dependencies": {
+    "@types/bcrypt": "^5.0.2",
+    "bcrypt": "^5.1.1",
     "@hono/node-server": "^1.19.5",
     "@orpc/client": "^1.8.8",
     "@orpc/server": "^1.8.8",
@@ -20,6 +22,7 @@
     "@tanstack/react-query": "^5.85.5",
     "dotenv": "^17.2.3",
     "hono": "^4.9.4",
+    "isomorphic-dompurify": "^2.16.0",
     "jsonrepair": "^3.13.0",
     "openai": "^5.17.0",
     "react": "^19.1.1",