Make the canonical card and link names the ones templates actually write
exorcise: template user-facing copy
audit Run 15 Phase 5: CSP script-src drops 'unsafe-inline'
ux: extract all executable inline JS from templates into static files