Port templates to NodeBB 4.14 benchpress escaping

NodeBB 4.14 registers a real __escape for template rendering (4.13 used
identity), so raw-HTML output must use the double-brace forms:
- HTML helpers: {{buildAvatar(...)}}, {{buildCategoryIcon(...)}}, etc.
- Pre-rendered HTML fields: {{txEscape(content)}} / {{./descriptionParsed}}
- Token-bearing text (nav labels, category names): {{tx(...)}}
- emails/partials/post-queue-body.tpl also adopts the 4.14 data shape
  (notification.category/topic/user/content).

Mirrors the harmony 2.2.72 -> 3.0.15 and core 4.13.2 -> 4.14.0 diffs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

templates/emails/digest.tpl

@@ -34,7 +34,7 @@
 {{{ end }}}
 </td>
 <td style="padding: 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; line-height: 16px; color: #3a3340;">
-<p style="margin: 0;"><a style="text-decoration:none !important; text-decoration:none; color: #a8893f;" href="{notifications.notification_url}">{notifications.bodyShort}</a></p>
+<p style="margin: 0;"><a style="text-decoration:none !important; text-decoration:none; color: #a8893f;" href="{notifications.notification_url}">{{notifications.bodyShort}}</a></p>
 </td>
 </tr>
 </table>
@@ -73,7 +73,7 @@
 <li style="text-decoration: none; list-style-type: none; padding-bottom: 0.5em;">
 <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%">
 <tr>
-<td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; width: 32px; vertical-align: middle;">{renderDigestAvatar(@value)}</td>
+<td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; width: 32px; vertical-align: middle;">{{renderDigestAvatar(@value)}}</td>
 <td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; line-height: 16px; color: #3a3340;">
 <p style="margin: 0;"><a style="text-decoration:none !important; text-decoration:none; color: #a8893f;" href="{url}/topic/{topTopics.slug}"><strong>{topTopics.title}</strong></a></p>
 <p style="margin: 0; font-size: 12px;"><a style="text-decoration:none !important; text-decoration:none; color: #9a9086; line-height: 16px;" href="{url}/uid/{topTopics.teaser.user.uid}"><strong>{topTopics.teaser.user.displayname}</strong></a></p>
@@ -108,7 +108,7 @@
 <li style="text-decoration: none; list-style-type: none; padding-bottom: 0.5em;">
 <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%">
 <tr>
-<td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; width: 32px; vertical-align: middle;">{renderDigestAvatar(@value)}</td>
+<td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; width: 32px; vertical-align: middle;">{{renderDigestAvatar(@value)}}</td>
 <td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; line-height: 16px; color: #3a3340;">
 <p style="margin: 0;"><a style="text-decoration:none !important; text-decoration:none; color: #a8893f;" href="{url}/topic/{popularTopics.slug}"><strong>{popularTopics.title}</strong></a></p>
 <p style="margin: 0; font-size: 12px;"><a style="text-decoration:none !important; text-decoration:none; color: #9a9086; line-height: 16px;" href="{url}/uid/{popularTopics.teaser.user.uid}"><strong>{popularTopics.teaser.user.displayname}</strong></a></p>
@@ -143,7 +143,7 @@
 <li style="text-decoration: none; list-style-type: none; padding-bottom: 0.5em;">
 <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%">
 <tr>
-<td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; width: 32px; vertical-align: middle;">{renderDigestAvatar(@value)}</td>
+<td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; width: 32px; vertical-align: middle;">{{renderDigestAvatar(@value)}}</td>
 <td style="padding: 6px 16px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; line-height: 16px; color: #3a3340;">
 <p style="margin: 0;"><a style="text-decoration:none !important; text-decoration:none; color: #a8893f;" href="{url}/topic/{recent.slug}"><strong>{recent.title}</strong></a></p>
 <p style="margin: 0; font-size: 12px;"><a style="text-decoration:none !important; text-decoration:none; color: #9a9086; line-height: 16px;" href="{url}/uid/{recent.teaser.user.uid}"><strong>{recent.teaser.user.displayname}</strong></a></p>

templates/emails/notification.tpl

@@ -20,7 +20,7 @@
 <tr class="notification-body">
 <td style="padding: 20px 40px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; font-size: 15px; line-height: 20px; color: #3a3340;">
 <p style="margin: 0; padding: 6px 0px; font-family: Jost, system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; font-size: 13px; line-height: 26px; color: #3a3340;">
-{body}
+{{txEscape(body)}}
 </p>
 </td>
 </tr>

templates/emails/partials/post-queue-body.tpl

@@ -1,18 +1,18 @@
 <p><strong>[[post-queue:category]]</strong></p>
-<p><a href="{category.url}" style="color: #a8893f;">{category.name}</a></p>
+<p><a href="{notification.category.url}" style="color: #a8893f;">{{tx(notification.category.name)}}</a></p>
 <p>
   <strong
-    >{{{ if topic.tid }}}[[post-queue:topic]]{{{ else }}}[[post-queue:title]]{{{
+    >{{{ if notification.topic.tid }}}[[post-queue:topic]]{{{ else }}}[[post-queue:title]]{{{
     end }}}</strong
   >
 </p>
 <p>
-  {{{ if topic.url }}}<a href="{topic.url}" style="color: #a8893f;">{topic.title}</a>{{{ else
-  }}}{topic.title}{{{ end }}}
+  {{{ if notification.topic.url }}}<a href="{notification.topic.url}" style="color: #a8893f;">{notification.topic.title}</a>{{{ else
+  }}}{notification.topic.title}{{{ end }}}
 </p>
 <p><strong>[[post-queue:user]]</strong></p>
 <p>
-  {{{ if user.url }}}<a href="{user.url}" style="color: #a8893f;">{user.username}</a>{{{ else
-  }}}{user.username}{{{ end }}}
+  {{{ if notification.user.url }}}<a href="{notification.user.url}" style="color: #a8893f;">{notification.user.username}</a>{{{ else
+  }}}{notification.user.username}{{{ end }}}
 </p>
-<p style="color: #3a3340;">{content}</p>
+<p style="color: #3a3340;">{{txEscape(notification.content)}}</p>