fix: HTML-escape all externally-sourced text in guide messages

- Escape app names, device names, and other_app_names in
  handle_device_guide, handle_app_selection, handle_specific_app_guide
- Redact internal paths and exception details from cabinet API
  error responses in _load_config, _save_config, and Remnawave
  fetch endpoints

app/cabinet/routes/admin_apps.py

@@ -129,18 +129,20 @@ def _load_config() -> dict:
     """Load app config from file."""
     config_path = _get_config_path()
     if not config_path.exists():
+        logger.error('App config file not found', path=str(config_path))
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail=f'App config file not found: {config_path}',
+            detail='App config file not found',
         )
 
     try:
         with open(config_path, encoding='utf-8') as f:
             return json.load(f)
     except json.JSONDecodeError as e:
+        logger.error('Failed to parse app config', error=e, path=str(config_path))
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f'Failed to parse app config: {e}',
+            detail='Failed to parse app config',
         )
 
 
@@ -152,9 +154,10 @@ def _save_config(config: dict) -> None:
         with open(config_path, 'w', encoding='utf-8') as f:
             json.dump(config, f, indent=2, ensure_ascii=False)
     except Exception as e:
+        logger.error('Failed to save app config', error=e, path=str(config_path))
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f'Failed to save app config: {e}',
+            detail='Failed to save app config',
         )
 
     try:
@@ -568,7 +571,7 @@ async def get_remnawave_subscription_config(
         logger.error('Error fetching RemnaWave config', error=e)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f'Failed to fetch config from RemnaWave: {e!s}',
+            detail='Failed to fetch config from RemnaWave',
         )
 
 
@@ -593,5 +596,5 @@ async def list_remnawave_subscription_configs(
         logger.error('Error listing RemnaWave configs', error=e)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f'Failed to fetch configs from RemnaWave: {e!s}',
+            detail='Failed to fetch configs from RemnaWave',
         )

app/handlers/subscription/devices.py

@@ -1300,7 +1300,7 @@ async def handle_device_guide(callback: types.CallbackQuery, db_user: User, db:
     other_apps = [app for app in apps if isinstance(app, dict) and app.get('id') and app.get('id') != featured_app_id]
 
     other_app_names = ', '.join(
-        str(app.get('name')).strip()
+        html_mod.escape(str(app.get('name')).strip())
         for app in other_apps
         if isinstance(app.get('name'), str) and app.get('name').strip()
     )
@@ -1325,13 +1325,13 @@ async def handle_device_guide(callback: types.CallbackQuery, db_user: User, db:
         texts.t(
             'SUBSCRIPTION_DEVICE_GUIDE_TITLE',
             '📱 <b>Настройка для {device_name}</b>',
-        ).format(device_name=get_device_name(device_type, db_user.language))
+        ).format(device_name=html_mod.escape(get_device_name(device_type, db_user.language)))
         + '\n\n'
         + link_section
         + texts.t(
             'SUBSCRIPTION_DEVICE_FEATURED_APP',
             '📋 <b>Рекомендуемое приложение:</b> {app_name}',
-        ).format(app_name=featured_app.get('name', ''))
+        ).format(app_name=html_mod.escape(featured_app.get('name', '')))
     )
 
     if other_app_names:
@@ -1452,7 +1452,7 @@ async def handle_app_selection(callback: types.CallbackQuery, db_user: User, db:
         texts.t(
             'SUBSCRIPTION_APPS_TITLE',
             '📱 <b>Приложения для {device_name}</b>',
-        ).format(device_name=get_device_name(device_type, db_user.language))
+        ).format(device_name=html_mod.escape(get_device_name(device_type, db_user.language)))
         + '\n\n'
         + texts.t('SUBSCRIPTION_APPS_PROMPT', 'Выберите приложение для подключения:')
     )
@@ -1525,7 +1525,10 @@ async def handle_specific_app_guide(callback: types.CallbackQuery, db_user: User
         texts.t(
             'SUBSCRIPTION_SPECIFIC_APP_TITLE',
             '📱 <b>{app_name} - {device_name}</b>',
-        ).format(app_name=app.get('name', ''), device_name=get_device_name(device_type, db_user.language))
+        ).format(
+            app_name=html_mod.escape(app.get('name', '')),
+            device_name=html_mod.escape(get_device_name(device_type, db_user.language)),
+        )
         + '\n\n'
         + link_section
     )