fix(kon): security audit fixes — CSP, XSS, unwraps, key rename

Security fixes from code audit:
- CSP re-enabled in tauri.conf.json with strict directives
  (was null — critical vulnerability)
- XSS fix in viewer highlightText(): HTML entities escaped before
  inserting <mark> tags via {@html}
- Removed 3 unwrap() calls in rule_based.rs British English conversion
  — replaced with safe let-else guards
- Removed unwrap() on main window lookup in lib.rs setup — now uses
  if-let for graceful handling
- Wrapped JSON.parse in DictationPage transcription-result listener
  with try/catch

Rebrand cleanup:
- Renamed all localStorage keys from ramble_* to kon_* across
  7 files (stores, viewer, float, history)

12 tests passing, clippy clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/float/+layout@.svelte

@@ -32,7 +32,7 @@
   // Listen for settings changes from main window
   if (typeof window !== "undefined") {
     window.addEventListener("storage", (e) => {
-      if (e.key === "ramble_settings" && e.newValue) {
+      if (e.key === "kon_settings" && e.newValue) {
         try {
           Object.assign(settings, JSON.parse(e.newValue));
         } catch {}