security: swap sanitizer to xss and harden logging

- Replace isomorphic-dompurify with xss to avoid ESM-only transitive
  dependencies (jsdom/htmlparser2) that break the existing Jest test suite.
- Sanitize rendered docs and Terms-of-Service HTML via xss() in routes/docs.js
  and routes/index.js.
- Remove full-object new-user logging from models/user_ldap.js and reduce
  login-path error output to error.name/error.message only.

Co-Authored-By: Claude <noreply@anthropic.com>

nodejs/package.json

@@ -30,7 +30,6 @@
     "express": "^5.2.1",
     "express-rate-limit": "^8.5.2",
     "extend": "^3.0.2",
-    "isomorphic-dompurify": "^3.19.0",
     "jq-repeat": "^2.2.0",
     "jquery": "^3.7.1",
     "jsonwebtoken": "^9.0.3",
@@ -42,7 +41,8 @@
     "mustache": "^4.2.0",
     "nodemailer": "^9.0.0",
     "p2psub": "^0.2.0",
-    "socket.io": "^4.8.3"
+    "socket.io": "^4.8.3",
+    "xss": "^1.0.15"
   },
   "license": "MIT",
   "repository": {