Port templates to NodeBB 4.14 benchpress escaping

NodeBB 4.14 registers a real __escape for template rendering (4.13 used
identity), so raw-HTML output must use the double-brace forms:
- HTML helpers: {{buildAvatar(...)}}, {{buildCategoryIcon(...)}}, etc.
- Pre-rendered HTML fields: {{txEscape(content)}} / {{./descriptionParsed}}
- Token-bearing text (nav labels, category names): {{tx(...)}}
- emails/partials/post-queue-body.tpl also adopts the 4.14 data shape
  (notification.category/topic/user/content).

Mirrors the harmony 2.2.72 -> 3.0.15 and core 4.13.2 -> 4.14.0 diffs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

templates/partials/categories/lastpost.tpl

@@ -3,12 +3,12 @@
 	{{{ if @first }}}
 	<div component="category/posts" class="ps-2 text-xs d-flex flex-column h-100 gap-1">
 		<div class="text-nowrap text-truncate">
-			<a class="text-decoration-none avatar-tooltip" title="{./user.displayname}" href="{config.relative_path}/user/{./user.userslug}">{buildAvatar(posts.user, "18px", true)}</a>
+			<a class="text-decoration-none avatar-tooltip" title="{./user.displayname}" href="{config.relative_path}/user/{./user.userslug}">{{buildAvatar(posts.user, "18px", true)}}</a>
 			<a class="permalink text-muted timeago text-xs" href="{config.relative_path}/topic/{./topic.slug}{{{ if ./index }}}/{./index}{{{ end }}}" title="{./timestampISO}" aria-label="[[global:lastpost]]"></a>
 		</div>
 		<div class="post-content text-xs text-break line-clamp-sm-2 lh-sm position-relative flex-fill">
 			<a class="stretched-link" tabindex="-1" href="{config.relative_path}/topic/{./topic.slug}{{{ if ./index }}}/{./index}{{{ end }}}" aria-label="[[global:lastpost]]"></a>
-			{./content}
+			{{txEscape(./content)}}
 		</div>
 	</div>
 	{{{ end }}}