fix(kon): security audit fixes — CSP, XSS, unwraps, key rename

Security fixes from code audit:
- CSP re-enabled in tauri.conf.json with strict directives
  (was null — critical vulnerability)
- XSS fix in viewer highlightText(): HTML entities escaped before
  inserting <mark> tags via {@html}
- Removed 3 unwrap() calls in rule_based.rs British English conversion
  — replaced with safe let-else guards
- Removed unwrap() on main window lookup in lib.rs setup — now uses
  if-let for graceful handling
- Wrapped JSON.parse in DictationPage transcription-result listener
  with try/catch

Rebrand cleanup:
- Renamed all localStorage keys from ramble_* to kon_* across
  7 files (stores, viewer, float, history)

12 tests passing, clippy clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/pages/HistoryPage.svelte

@@ -129,11 +129,11 @@
   async function openViewer(item) {
     // Store item data for the viewer window
     try {
-      localStorage.setItem("ramble_viewer_item", JSON.stringify(item));
+      localStorage.setItem("kon_viewer_item", JSON.stringify(item));
       await invoke("open_viewer_window");
     } catch {
       // Fallback: open in browser tab (dev mode)
-      localStorage.setItem("ramble_viewer_item", JSON.stringify(item));
+      localStorage.setItem("kon_viewer_item", JSON.stringify(item));
       window.open("/viewer", "_blank", "width=600,height=700");
     }
   }