#1029 Pre-installed welcome_email app and api/app_templates welcome emails interpolate caller values into HTML unescaped

Found during #1018 sweep, not fixed there: enterprise/apps/pre_installed/welcome_email.py send (recipient_name, tenant_id, login/doc URLs) and api/app_templates/welcome_email.py, welcome_email_with_secret.py format raw values into HTML. #1018 fixed api/blueprints/v1/users_helpers.py, api/utils/invitation_email.py and enterprise/apps/pre_installed/invitation_email.py. EARS: When an app builds an HTML email body, every caller-supplied value shall be HTML-escaped (html is in the app import allowlist). Pre-installed app source changes reach tenants only through a published version + per-tenant upgrade.