fix(security): use html/template for email rendering to prevent SSTI

[lakhansamani]

Summary

• Switch from text/template to html/template for email template rendering
• html/template provides context-aware auto-escaping, preventing server-side template injection via admin-configured email templates
• API is identical — no functional changes, only security hardening

Files Changed

• internal/email/email.go — import change from text/template to html/template

Test plan

• make test-sqlite passes (no regressions)
• Verify email templates render correctly with HTML content
• Verify special characters in user data are properly escaped