Fix: HTML renders as full page without escaping; only plain text files (txt/md/json) are wrapped and escaped.