frontend: fix CSP-dead modal close buttons, consolidate escapeHtml (audit Run 20 Phase 6)
ux: extract all executable inline JS from templates into static files