ui: harden streaming page rendering

TASKS.md

@@ -2,20 +2,18 @@
 
 ## Current
 
-### `feat/distributed-mcp-session-store`
+### `feat/frontend-xss-hardening`
 
 Status: in_progress
 
 DoD:
-- transport sessions are stored behind a shared store abstraction
-- mcp-server no longer depends directly on process-local session storage implementation
-- in-memory session store remains available for tests and local fallback
-- production mcp-server uses a Postgres-backed transport session store
-- expired transport sessions are evicted on read and no longer leak indefinitely
+- API-provided values are not rendered into `innerHTML` on user-facing admin pages
+- error strings from API responses are rendered through text nodes
+- streaming admin pages use DOM construction instead of HTML string concatenation for dynamic cards
 
 ## Next
 
-- `feat/runtime-rate-limiting-and-backpressure`
+- `feat/distributed-mcp-session-store`
 
 ## Backlog