Bug: HTML entity replacements missing semicolons (&lt/&gt) — sliced entities render as garbage text in typed-word overlay

Did you clear cache before opening an issue?

• I have cleared my cache

Is there an existing issue for this?

• I have searched the existing open and closed issues

Does the issue happen when logged in?

Yes

Does the issue happen when logged out?

Yes

Does the issue happen in incognito mode when logged in?

Yes

Does the issue happen in incognito mode when logged out?

Yes

Issue details

Current Behavior

Two spots replace < / > with HTML entities but omit the trailing semicolon, producing non-standard references that interact badly with .slice():

// frontend/src/ts/test/result-word-highlight.ts:314-319
inputWordEl.innerHTML = userInputString
  .replace(/\t/g, "_")
  .replace(/</g, "&lt") // no semicolon
  .replace(/>/g, "&gt") // no semicolon
  .slice(0, wordEl.childElementCount);

// frontend/src/ts/test/test-ui.ts:1405-1409 — same pattern

Because the slice happens after replacement, input ending in < gets truncated mid-entity (e.g. &l), which then renders as literal garbage text instead of <. Legacy-style semicolon-less entities also double-decode oddly when adjacent entity-like text exists in the typed string.

Expected Behavior

Replace before slicing with proper entities (or escape after slicing):

.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")

Ideally both call sites would share one escaping helper (e.g. reuse Misc.escapeHTML from utils/misc.ts:137-145, which already escapes correctly).

Steps To Reproduce

1. Type a word containing < such that the input length exceeds the word length so .slice() cuts inside the appended entity (e.g. type abc< against word xyz).
2. Observe raw &l fragments rendered in the input overlay instead of the < character.

Environment

• OS: Any
• Browser: Any
• Found via source review of master @ 91bd24bb8