fix(client): address PR #65 round 2 — broken tests, BBCode escape, expiry loop

- test_journal_sprint18.gd: replace references to removed
  CONFIDENCE_LABELS/SOURCE_LABELS with UIStrings key tests and
  regression guards
- dialogue_box.gd: escape ] as [rb] in _escape_bbcode for complete
  BBCode injection protection
- dialogue_box.gd: fix _expire_entries to skip pinned entries with
  continue instead of break, cleaning expired entries behind pins

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

client/ui/dialogue_box.gd

@@ -538,7 +538,7 @@ func _format_entry(entry: Dictionary, alpha: float) -> String:
 
 ## Escape BBCode bracket characters in server-sourced text (Hoshe #2).
 static func _escape_bbcode(text: String) -> String:
-	return text.replace("[", "[lb]")
+	return text.replace("[", "[lb]").replace("]", "[rb]")
 
 
 ## Get a stable color for a character name, with contrast floor enforcement.
@@ -594,19 +594,22 @@ func _expire_entries() -> void:
 	var removed := false
 	var has_fading := false
 
-	# Remove expired non-pinned entries from the front (oldest first)
-	while _log_entries.size() > 0:
-		var entry: Dictionary = _log_entries[0]
+	# Remove expired non-pinned entries (oldest first, skipping pinned)
+	var i := 0
+	while i < _log_entries.size():
+		var entry: Dictionary = _log_entries[i]
 		if entry.pinned:
-			break  # Pinned entries never expire
+			i += 1
+			continue  # Pinned entries never expire — keep scanning
 		var age: int = now - entry.timestamp_msec
 		if age < total_lifetime_msec:
 			# Check if this entry is in the fading phase
 			if age > int(_entry_lifetime * 1000.0):
 				has_fading = true
 			break
-		_log_entries.remove_at(0)
+		_log_entries.remove_at(i)
 		removed = true
+		# Don't increment i — element at i is now the next entry
 
 	# Check remaining entries for fading state
 	if not has_fading: