fix(kon): security audit fixes — CSP, XSS, unwraps, key rename

Security fixes from code audit:
- CSP re-enabled in tauri.conf.json with strict directives
  (was null — critical vulnerability)
- XSS fix in viewer highlightText(): HTML entities escaped before
  inserting <mark> tags via {@html}
- Removed 3 unwrap() calls in rule_based.rs British English conversion
  — replaced with safe let-else guards
- Removed unwrap() on main window lookup in lib.rs setup — now uses
  if-let for graceful handling
- Wrapped JSON.parse in DictationPage transcription-result listener
  with try/catch

Rebrand cleanup:
- Renamed all localStorage keys from ramble_* to kon_* across
  7 files (stores, viewer, float, history)

12 tests passing, clippy clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/pages/DictationPage.svelte

@@ -47,9 +47,15 @@
 
   onMount(async () => {
     unlisten = await listen("transcription-result", (event) => {
-      const result = typeof event.payload === "string"
-        ? JSON.parse(event.payload)
-        : event.payload;
+      let result;
+      try {
+        result = typeof event.payload === "string"
+          ? JSON.parse(event.payload)
+          : event.payload;
+      } catch (e) {
+        console.error("Failed to parse transcription result:", e);
+        return;
+      }
       handleResult(result);
     });