docs: clarify unsafe error rendering case

__REVIEW_FRONT.md

@@ -165,6 +165,14 @@ Actions:
   - safe toast body
   - pre-defined empty/error state templates
 
+Explicit case to fix:
+
+- `apps/ui/js/secrets.js`
+  - current pattern builds `profilesList.innerHTML` using `state.error`
+  - `state.error` is populated from caught API/fetch error text
+  - that makes server-provided message text an unsafe HTML source
+  - this renderer must be rewritten to build DOM nodes and place the message through `textContent`
+
 ### Acceptance Criteria
 
 - no API-provided field is rendered via raw `innerHTML`;