fix(catalog): decode and strip stray markup from product descriptions

P0-5: some catalog listings (live backend data, proxied third-party
marketplace via novo.market) carry HTML-entity-encoded markup in
their description field, e.g. '<attention>...</attention>'
and '"AppStops"' — rendered verbatim as visible text on
search-result cards and the PDP description tab.

Added a pure cleanDescription() util (item.utils.ts) that decodes
the common HTML entities and strips any resulting tag-like markup,
then wired it into ProductCardComponent (covers Home/Catalog/Search/
Wishlist/Compare/PDP-similar) and ProductDescriptionComponent (PDP
description tab). Output stays a plain string rendered via text
interpolation (never innerHTML), so this only cleans up display —
it introduces no HTML-rendering/XSS surface.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/utils/item.utils.ts

@@ -45,6 +45,30 @@ export function getBadgeClass(badge: string): string {
   return map[badge.toLowerCase()] || 'badge-custom';
 }
 
+const HTML_ENTITY_MAP: Record<string, string> = {
+  '&lt;': '<',
+  '&gt;': '>',
+  '&quot;': '"',
+  '&#39;': "'",
+  '&apos;': "'",
+  '&nbsp;': ' ',
+  '&amp;': '&',
+};
+
+/**
+ * Cleans up seller-supplied description text for safe plain-text display: decodes
+ * HTML entities (some catalog listings arrive HTML-escaped, e.g. "&lt;attention&gt;")
+ * and strips any resulting tag-like markup. Never renders as HTML — output stays a
+ * plain string for text interpolation, so this cannot introduce an XSS surface.
+ */
+export function cleanDescription(text: string | undefined | null): string {
+  if (!text) {
+    return '';
+  }
+  const decoded = text.replace(/&lt;|&gt;|&quot;|&#39;|&apos;|&nbsp;|&amp;/g, match => HTML_ENTITY_MAP[match]);
+  return decoded.replace(/<\/?[a-zA-Z][^>]*>/g, '').trim();
+}
+
 /**
  * Get the translated name/description for the current language.
  * Checks translations map first, then names[]/descriptions[] arrays,