fix: correct HTML entity encoding and file permission mask

[Sim-hu]

Summary

Two small bug fixes: an HTML entity encoding bug and an overly permissive file permission setting.

Changes

1. Fix parseHTML() entity encoding

File: js/parseFunctions.js

- s == '<' ? '&lt;' : s == '>' ? '&gt;' : '&amp'
+ s == '<' ? '&lt;' : s == '>' ? '&gt;' : '&amp;'

The & character was being replaced with &amp (missing trailing semicolon), which is not a valid HTML entity. This could cause rendering issues in certain HTML parsers.

2. Fix process.umask(0) security issue

File: js/app.js

- process.umask(0);
+ process.umask(0o022);

process.umask(0) clears all permission restriction bits, meaning any files created by the application are readable, writable, and executable by all users on the system. Changed to the standard default umask 0o022, which restricts group/other write permissions while still allowing the application to function normally.

Test plan

• Messages containing & characters render correctly in the UI
• Files created by the application have expected restrictive permissions