feat: enhance notification system and integrate DOMPurify for HTML sanitization

- Added `dompurify` for improved HTML sanitization in the play rules.
- Updated `PlayerNotificationBell` component to handle unread notifications and improve user interaction.
- Enhanced `usePendingWalletReconcile` hook to manage unread notifications and mark them as read.
- Added new translations for notification-related texts in English, Nepali, and Chinese to support multilingual users.

src/lib/play-rules-html.ts

@@ -1,4 +1,5 @@
 import { normalizeLanguage, type AppLanguage } from "@/i18n/language";
+import DOMPurify from "dompurify";
 
 const KEY_LEGACY = "frontend.play_rules_html";
 const KEY_ZH = "frontend.play_rules_html_zh";
@@ -7,13 +8,30 @@ const KEY_NE = "frontend.play_rules_html_ne";
 
 type SettingItem = { key: string; value: unknown };
 
-function removeScriptTags(html: string | null): string | null {
+function sanitizeHtml(html: string | null): string | null {
   if (!html) return html;
-  // React won't execute scripts injected via `dangerouslySetInnerHTML`.
-  // Removing them avoids the warning and prevents unintended script injection.
-  return html
-    .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "")
-    .replace(/<script\b[^>]*\/>/gi, "");
+
+  return DOMPurify.sanitize(html, {
+    USE_PROFILES: { html: true },
+    FORBID_TAGS: [
+      "script",
+      "style",
+      "iframe",
+      "object",
+      "embed",
+      "form",
+      "input",
+      "button",
+      "textarea",
+      "select",
+      "option",
+      "link",
+      "meta",
+      "base",
+    ],
+    FORBID_ATTR: ["style"],
+    ALLOW_DATA_ATTR: false,
+  });
 }
 
 function asNonEmptyString(value: unknown): string | null {
@@ -38,10 +56,10 @@ export function resolvePlayRulesHtml(
   const lang: AppLanguage = normalizeLanguage(language);
 
   if (lang === "zh") {
-    return removeScriptTags(zh ?? legacy);
+    return sanitizeHtml(zh ?? legacy);
   }
   if (lang === "ne") {
-    return removeScriptTags(ne ?? en ?? zh ?? legacy);
+    return sanitizeHtml(ne ?? en ?? zh ?? legacy);
   }
-  return removeScriptTags(en ?? zh ?? legacy);
+  return sanitizeHtml(en ?? zh ?? legacy);
 }