Harden registration system: XSS-safe DOM, email normalization, instanceof guard

[Copilot]

Addresses three security/correctness issues flagged in review: unsafe HTML interpolation in the activity card renderer, missing type guard before closest(), and email inputs accepted without normalization (enabling duplicate-bypass via case or whitespace).

Changes

src/static/app.js

• Replaced innerHTML string interpolation with DOM API construction (createElement, textContent, dataset) throughout the activity card renderer — eliminates stored XSS and attribute injection vectors
• Added instanceof Element guard on event.target before calling .closest() in the unregister click handler

const target = event.target;
if (!(target instanceof Element)) return;
const removeButton = target.closest(".participant-remove-btn");

src/app.py

• Normalize email with .strip().lower() in both signup_for_activity and unregister_from_activity before membership checks or storage, preventing case/whitespace bypass

email = email.strip().lower()
if email in activity["participants"]:
    raise HTTPException(status_code=400, detail="Student already signed up")

tests/test_app.py

• Added tests covering: mixed-case email stored as lowercase, case-insensitive duplicate rejection, and case-insensitive unregister

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.