Fix critical security vulnerabilities

[alxlion]

Summary

Addresses 5 critical findings from a comprehensive security audit of the codebase:

• C1 - Stored XSS via custom embeds: Sanitize custom embed HTML at the changeset level, stripping everything except <iframe> tags with whitelisted attributes (src, width, height, frameborder, allow, allowfullscreen, etc.). Blocks javascript: URIs in src.
• C2 - Reflected XSS via URL formatting: Escape URLs with Phoenix.HTML.html_escape/1 before interpolating into <a> tags in format_body/1, preventing attribute injection via crafted URLs in post messages.
• C3 - IDOR on form data export: Add authorize_event_access/2 check to export_form/2 in StatController, matching the authorization pattern already used by export_poll, export_quiz, and export_all_messages.
• C4 - Atom exhaustion DoS: Replace all 8 instances of String.to_atom/1 on user-controlled input with explicit whitelists or String.to_existing_atom/1 across 6 files (converter, show, manage, dashboard, table actions, form component).
• C6 - Missing rate limiting: Add hammer dependency with ETS backend and a RateLimitPlug that enforces 10 requests/minute per IP on all authentication routes (login, registration, password reset, confirmation).

C5 (unprotected file serving via Plug.Static) is deferred for a separate PR.

Test plan

• mix test test/claper/embeds_test.exs — all 11 embed tests pass (including custom embed sanitization)
• mix format --check-formatted passes
• Full test suite: 209 tests, 34 pre-existing failures (none introduced by this PR)
• Manual: create custom embed with <script> tag alongside iframe — verify only iframe is stored
• Manual: post message with http://x.com" onclick="alert(1)" — verify " is escaped
• Manual: call POST /export/forms/:id as non-owner — verify 403
• Manual: send invalid atom values via LiveView events — verify graceful handling
• Manual: rapid-fire login attempts — verify 429 after 10 requests