ref(debug): Render the email preview in a sandboxed iframe

[oioki]

The email preview rendered a whole HTML document inline via dangerouslySetInnerHTML, so the app's CSS and the email's leaked into each other — the app's fonts bled into the email, and the email's styles bled onto the debug page. The result didn't match what any mail client would show.

Render it in a sandboxed iframe instead, so the email is isolated as its own document. Sanitized with DOMPurify (WHOLE_DOCUMENT: true); sandbox without allow-scripts keeps it inert.

Also removes the dangerouslySetInnerHTML sink and corrects html_content's type (it's a plain string, not TrustedHTML).

The old inline render let the app's CSS leak into the email (hence the Rubik heading); the iframe isolates it, so it now renders in the email's own fonts — much closer to how it'd actually look in an inbox, see:

Before (Rubik)

https://sentry.sentry.io/debug/notifications/activity-set-regression/

After

How it actually looks in the email client (similar font to After)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e5d5461. Configure here.}