Fix webview compliance issues

[njb90]

• Removed unsafe createWebviewDocument (no CSP, no nonce) and its escapeHtml import — all callers already use webviewUtils.ts
• escapeHtml(cloudName) → JSON.stringify(cloudName) — escapeHtml HTML-encodes & to & inside JS strings, JSON.stringify is the correct escaping for JS contexts
• Replaced innerHTML template with DOM APIs — fileName is now set via .title and .textContent
• Replaced card.innerHTML template with DOM APIs — asset.public_id, asset.secure_url, and
  folderDisplay are now set via setAttribute/textContent