- BUG-1: Strip HTML tags in sanitizeName (prevent stored XSS) - BUG-2: Strip HTML tags in notes via sanitizeText across all 3 booking APIs - BUG-3: Dashboard excludes archived/past MCs and expired Open Day events from counts - BUG-4: Truncate long names in booking cards to prevent overflow