Sync broccolini-bot: rename from zammad, docs in docs/, security gitignore, remove zammad deps

Co-authored-by: Cursor <cursoragent@cursor.com>

utils.js

@@ -13,6 +13,17 @@ function escapeRegex(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/** Escape for safe use in HTML body (prevents XSS in outgoing emails). */
+function escapeHtml(str) {
+  if (str == null) return '';
+  return String(str)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
 function decodeHtmlEntities(str) {
   if (!str) return '';
   return str
@@ -267,6 +278,7 @@ function replaceVariables(template, context = {}) {
 module.exports = {
   BLOCK_TAG_REGEX,
   escapeRegex,
+  escapeHtml,
   decodeHtmlEntities,
   htmlToTextWithBlocks,
   decodeGmailData,