feat: enhance wallet transfer handling and improve HTML safety

- Added emitWalletRefresh function to trigger wallet refresh events after successful transfers and error handling.
- Introduced removeScriptTags function to sanitize HTML content by removing script tags, preventing potential security issues.
- Updated transfer handling logic to ensure wallet refresh is emitted in relevant scenarios, improving user experience.

src/lib/play-rules-html.ts

@@ -7,6 +7,15 @@ const KEY_NE = "frontend.play_rules_html_ne";
 
 type SettingItem = { key: string; value: unknown };
 
+function removeScriptTags(html: string | null): string | null {
+  if (!html) return html;
+  // React won't execute scripts injected via `dangerouslySetInnerHTML`.
+  // Removing them avoids the warning and prevents unintended script injection.
+  return html
+    .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "")
+    .replace(/<script\b[^>]*\/>/gi, "");
+}
+
 function asNonEmptyString(value: unknown): string | null {
   if (typeof value !== "string") {
     return null;
@@ -29,10 +38,10 @@ export function resolvePlayRulesHtml(
   const lang: AppLanguage = normalizeLanguage(language);
 
   if (lang === "zh") {
-    return zh ?? legacy;
+    return removeScriptTags(zh ?? legacy);
   }
   if (lang === "ne") {
-    return ne ?? en ?? zh ?? legacy;
+    return removeScriptTags(ne ?? en ?? zh ?? legacy);
   }
-  return en ?? zh ?? legacy;
+  return removeScriptTags(en ?? zh ?? legacy);
 }