Harden DSL parsing against escapes and malformed tags

Fixed escape-aware headword parsing for \{, \}, \[ and trailing backslash.
Fixed O(n^2) tag scan and nested bracket handling in article rendering.

app/src/main/java/com/example/research/ui/article/DslAnnotatedParser.kt

@@ -119,7 +119,7 @@ object DslAnnotatedParser {
                     i++
                 }
                 '[' -> {
-                    val end = dsl.indexOf(']', i + 1)
+                    val end = tagCloseIndex(dsl, i + 1)
                     if (end != -1) {
                         val tagStart = i + 1
                         var tagEnd = end
@@ -228,6 +228,19 @@ object DslAnnotatedParser {
         splitOversizedBlocks(result)
     }
 
+    private fun tagCloseIndex(value: String, startIndex: Int): Int {
+        var index = startIndex
+        while (index < value.length) {
+            when {
+                value[index] == '\\' && index + 1 < value.length -> index += 2
+                value[index] == '[' -> return -1
+                value[index] == ']' -> return index
+                else -> index++
+            }
+        }
+        return -1
+    }
+
     private fun splitOversizedBlocks(blocks: List<DslBlock>): List<DslBlock> {
         if (blocks.none { it.text.length > MAX_BLOCK_TEXT_LENGTH }) return blocks
         return blocks.flatMap { block ->