fix(dashboard): show chart tooltip labels as text, and decode keys like the api does (24.05)

[ar2rsawseen]

Backport of #7882, which has the full write-up. All three functions are identical on this branch, so the patch applied unchanged.

sanitizeHtml encoded its input and then immediately unescaped it. Those two are inverses, so it returned the input unchanged and a label containing markup went into a tooltip template as markup rather than being shown as text. It now normalises first and escapes last: undo the html escaping the api applies, undo the key substitutions, then escape once.

Separately, the dashboard's key decoder undid only $ and . while the api encoder also substitutes NUL and the api decoder accepts the url encoded forms, so &#9647, $ and . reached callers still encoded. Both directions of the dashboard pair now match the api.

One visible consequence: a value containing NUL shows the character itself, which is invisible, where it previously showed the placeholder glyph the browser resolved &#9647 into. NUL in a key or segment value is pathological, and the alternative was leaving one of the two decoders knowingly incomplete.

Verification

• 43 tests, all passing here unchanged: 13 on the tooltip helper (4 fail without the change) and 30 asserting the two substitution pairs agree behaviourally (6 fail without it).
• Full unit suite: 101 passing before, 144 after, same 5 pre-existing failures (validateArgs extra types, Countly Request). Baseline captured by reverting and re-running.
• eslint clean. No raw NUL bytes in the source; the escape is written as \u0000.

🤖 Generated with Claude Code