Port templates to NodeBB 4.14 benchpress escaping (#19)

NodeBB 4.14 turned on real HTML escaping for single-brace template interpolations (4.13 used an identity escape). This ports raw-HTML output to the double-brace forms ({{helper(...)}}, {{txEscape(content)}}, {{tx(name)}}), mirroring the harmony 2.2.72 -> 3.0.15 and core 4.13.2 -> 4.14.0 template diffs. Fixes the escaped-markup breakage on westgate.pw after the 2026.07.11-1 deploy.

Verified on a fresh 4.14.0 dev stack: no escaped tags on /, /categories, /category/2, /topic/1, /search; contract tests pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: vickydotbat <vickydotbat@tutamail.com>
Reviewed-on: #19
Reviewed-by: xtul <mpiasecki720@protonmail.com>
Co-authored-by: gitea-bot <gitea-bot@noreply.git.westgate.pw>
Co-committed-by: gitea-bot <gitea-bot@noreply.git.westgate.pw>

templates/partials/categories/lastpost.tpl

@@ -3,12 +3,12 @@
 	{{{ if @first }}}
 	<div component="category/posts" class="ps-2 text-xs d-flex flex-column h-100 gap-1">
 		<div class="text-nowrap text-truncate">
-			<a class="text-decoration-none avatar-tooltip" title="{./user.displayname}" href="{config.relative_path}/user/{./user.userslug}">{buildAvatar(posts.user, "18px", true)}</a>
+			<a class="text-decoration-none avatar-tooltip" title="{./user.displayname}" href="{config.relative_path}/user/{./user.userslug}">{{buildAvatar(posts.user, "18px", true)}}</a>
 			<a class="permalink text-muted timeago text-xs" href="{config.relative_path}/topic/{./topic.slug}{{{ if ./index }}}/{./index}{{{ end }}}" title="{./timestampISO}" aria-label="[[global:lastpost]]"></a>
 		</div>
 		<div class="post-content text-xs text-break line-clamp-sm-2 lh-sm position-relative flex-fill">
 			<a class="stretched-link" tabindex="-1" href="{config.relative_path}/topic/{./topic.slug}{{{ if ./index }}}/{./index}{{{ end }}}" aria-label="[[global:lastpost]]"></a>
-			{./content}
+			{{txEscape(./content)}}
 		</div>
 	</div>
 	{{{ end }}}