/** * Tiny `{token}` substitution helper for translated strings. * * Why this exists * --------------- * Two ad-hoc substitution mechanisms had grown in the SDK: * - per-key country splicing inside `getLocale` (hard-coded, not reusable); * - inline `.replace('{value}', …)` at call sites (curing). * Neither escaped values. Since several translated strings are concatenated * into HTML and then HTML-parsed by `JsxFromString`, unescaped user input * would be an XSS vector. This helper unifies substitution and makes * "values may be user-entered" safe by default. * * Contract * -------- * - The **template** is author-controlled. It may legitimately contain HTML * (``, `