fix(security): HTML-escape site_name 并对 doc_url 统一应用 sanitizeUrl

Refs #3839 (第 8、12 点)

backend/internal/handler/admin/setting_handler_email.go

@@ -1,6 +1,7 @@
 package admin
 
 import (
+	"html"
 	"strings"
 
 	"github.com/Wei-Shaw/sub2api/internal/handler/dto"
@@ -163,7 +164,7 @@ func (h *SettingHandler) SendTestEmail(c *gin.Context) {
 <body>
     <div class="container">
         <div class="header">
-            <h1>` + siteName + `</h1>
+            <h1>` + html.EscapeString(siteName) + `</h1>
         </div>
         <div class="content">
             <div class="success">✓</div>