fix: add <mark> highlighting to search match context snippets

The command palette renders matchContext via dangerouslySetInnerHTML
expecting HTML with <mark> tags, but extractSnippet() returned plain
text. Wrap the matched term in <mark> tags and escape surrounding
text to prevent XSS.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/search/ClickHouseSearchIndex.java

@@ -289,7 +289,14 @@ public class ClickHouseSearchIndex implements SearchIndex {
         if (idx < 0) return null;
         int start = Math.max(0, idx - contextChars / 2);
         int end = Math.min(text.length(), idx + searchTerm.length() + contextChars / 2);
-        return (start > 0 ? "..." : "") + text.substring(start, end) + (end < text.length() ? "..." : "");
+        String before = escapeHtml(text.substring(start, idx));
+        String match = escapeHtml(text.substring(idx, idx + searchTerm.length()));
+        String after = escapeHtml(text.substring(idx + searchTerm.length(), end));
+        return (start > 0 ? "..." : "") + before + "<mark>" + match + "</mark>" + after + (end < text.length() ? "..." : "");
+    }
+
+    private static String escapeHtml(String s) {
+        return s.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;");
     }
 
     private static String escapeLike(String term) {