fix: preserve $$ and other special chars in user input template substitution

[octo-patch]

Fixes #6574

Problem

When a user sends a message containing $$...$$ (LaTeX display math), the double dollar signs get silently converted to single dollar signs ($...$, inline math) in the stored message. The preview bubble (shown while typing) renders correctly because it uses the raw input string directly, but after submission the content passes through fillTemplateWith(), which uses String.prototype.replace() with the user input as the literal replacement string.

JavaScript's String.prototype.replace() treats several patterns in the replacement string as special directives:

Pattern	Meaning
$$	Inserts a literal $
$&	Inserts the matched substring
$'	Inserts the string after the match
$`	Inserts the string before the match

So "{{input}}".replace(/{{input}}/g, "$$e=mc^2$$") returns "$e=mc^2$" — stripping one pair of dollar signs.

The same issue affects any user input containing $&, $', or $`.

Solution

Use a function callback in .replace() instead of a string literal. When the replacement is a function, JavaScript passes no special treatment to its return value:

// Before (buggy)
output = output.replace(regex, value.toString());

// After (fixed)
output = output.replace(regex, () => value.toString());

Testing

// Verify the fix
const buggy = "{{input}}".replace(/{{input}}/g, "$$e=mc^2$$");
// → "$e=mc^2$"  ← WRONG

const fixed = "{{input}}".replace(/{{input}}/g, () => "$$e=mc^2$$");
// → "$$e=mc^2$$"  ← CORRECT

All other special patterns ($&, $', $`) are also fixed by this single change.