fix: sanitize daily report HTML for Telegram parse_mode

Strip div/br tags unsupported by Telegram API; reports still store UI HTML in details

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_daily_report.py

@@ -16,7 +16,7 @@ from app.services.daily_report import (
     run_daily_reports,
 )
 from app.services.notification_policy import NotificationPolicyConfig
-from app.services.telegram_templates import format_event_telegram_html
+from app.services.telegram_templates import format_event_telegram_html, sanitize_telegram_html
 
 
 def _ssh_host(db) -> Host:
@@ -209,4 +209,9 @@ def test_daily_report_telegram_html_uses_report_html(db_session):
         details={"report_html": "<b>📊 OK</b><br>line"},
         payload={},
     )
-    assert format_event_telegram_html(event) == "<b>📊 OK</b><br>line"
+    assert format_event_telegram_html(event) == "<b>📊 OK</b>\nline"
+
+
+def test_sanitize_telegram_html_strips_div_and_br():
+    raw = '<div class="agent-report">a<br>b</div>'
+    assert sanitize_telegram_html(raw) == "a\nb"

backend/tests/test_telegram_templates.py

@@ -10,6 +10,12 @@ def test_html_escape_special_chars():
     assert html_escape("a<b>&") == "a&lt;b&gt;&amp;"
 
 
+def test_sanitize_telegram_html_keeps_bold():
+    from app.services.telegram_templates import sanitize_telegram_html
+
+    assert sanitize_telegram_html("<b>title</b><br>line") == "<b>title</b>\nline"
+
+
 def test_rdp_failed_template_includes_user_ip_logon():
     host = Host(hostname="K6A-DC3", display_name="UNMS Kalina", os_family="windows")
     event = Event(