server: set wizard upload error text via textContent, not innerHTML
ux: extract all executable inline JS from templates into static files