web_escape (main.rs) and escape_html (auth.rs, web.rs) were three byte-identical copies of the same & < > " ' replacement chain. Moved into src/html.rs as html::escape and used from all three call sites.