Security Fix: Removed innerHTML Usage

What was fixed: Replaced all innerHTML assignments with safe DOM manipulation methods using createElement() and appendChild() to prevent XSS vulnerabilities.

Why it matters: Using innerHTML can expose the extension to script injection attacks. The new approach creates DOM elements programmatically, ensuring user input and external data cannot execute as code.

Key changes:
- Created helper functions createElement() and clearElement() for safe DOM manipulation
- All dynamic content now uses textContent instead of innerHTML
- Color swatches, labels, and UI elements are built using proper DOM methods
- No functional changes - the extension works exactly the same, just more securely

This makes the extension compliant with modern security standards and store requirements.