4 Commits

Author	SHA1	Message	Date
fs	35a36f1144	fix(security): replace innerHTML with safe DOM APIs, add destroy() cleanup ... Replace innerHTML assignments in app-tabs.js and app-password-toggle.js with createElement/appendChild to prevent potential XSS vectors. Add destroy() methods to app-tabs, app-filter-drawer, and app-toggle-aside-panels so document/window-level listeners can be properly removed when components are torn down. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 22:35:01 +01:00
fs	d9f07dcd63	fix: web/ quick wins — CSS cleanup, ARIA tabs, and file header comments ... CSS: - Remove duplicate li::before block in app-search.css - Fix typo: search-reuslt → search-result in app-search.css - Remove commented-out CSS rules in app-flash.css - Add descriptive header comment to all 27 CSS component files JS: - Complete WAI-ARIA Tabs pattern: generate IDs, add aria-controls on tab buttons and aria-labelledby on tab panels (app-tabs.js) - Add JSDoc header comments to ~33 JS files (core + components) - Add explanatory block comment to app-boot.js (why classic IIFE) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 22:21:37 +01:00
fs	7153fec05c	feat(auth): harden login flows and finalize quality-check coverage	2026-03-07 22:54:33 +01:00
fs	9168730a8a	further things around login	2026-03-07 21:21:47 +01:00