feat(phase-34): add 10 Phase 34 client methods to api.js

feat(phase-33): add 6 Phase 33 client methods to api.js

fix(phase-33): fix _renderTimeline to call /timeline/ not /biography/

fix(B-06): confirm filter button data-nav-path fix applied + wire addEventListener

fix(B-29): replace misleading 'court-grade PDF' claim with accurate disclaimer

fix(B-15): remove extra brace orphaning else branch in liveFeed ws.onmessage

fix(LOGIC-3): preserve &lang= in search filter buttons and search button handler

fix(SEC-1,CodeQL#24): data-* attrs for connection-map evidence onclick -- prevents single-quote XSS

fix(UI-6): replace corrupted unicode chars in connection map legend with HTML entities

fix(UI-2): set evidence panel width to min(460px,100vw) -- no longer overflows on 375px phones

fix(TEXT-1): update hardcoded '12 investigators' to '15' in How It Works and About page

fix(I18N-1,I18N-3): add mni/sat/ks to navbar language dropdown; restore all corrupted Indian script labels in search page dropdown

fix(SEARCH-2,SEARCH-3): add datagov/crimereport filter buttons; add Arabic script U+0600-U+06FF to ALLOWED_CHARS for Urdu/Sindhi search

fix(LOGIC-4): persist language selection to localStorage -- language now survives page refresh

fix(SEC-1,CodeQL#24): sanitize entity name, type, profile.overview k/v, and risk.explanation before innerHTML injection

fix(FEED-1): add pipeline-message guard in liveFeed view -- admin system message no longer shown as fake intelligence

fix(FEED-2): reset connect._retries=0 on each _connectFeedToHome() call -- prevents permanent feed silence after repeated navigation

fix(JS-4,FEED-4): stop D3 simulation and close WebSocket on route navigation -- prevents CPU/memory leak

fix(JS-2): remove duplicate GraphRenderer._currentSimulation assignment in graph.js

fix(DUP-1): remove duplicate search input prefill block -- same code appeared twice with different variable names

fix(JS-1 CRITICAL): remove 2 duplicate const _langLabelCache declarations -- caused SyntaxError crash in strict-mode browsers

fix(SyntaxError): move _stats_cache vars to module level; global declaration must precede use -- fixes CI SyntaxError on line 142

fix(M-10,M-11,L-06): deterministic node ID fallback; container-scoped SVG marker; store simulation for tab-switch cleanup

fix(M-05): cache language labels in applyLanguage() -- avoids redundant API calls on rapid language switching

fix(M-05): cache language labels in applyLanguage() -- avoids redundant API calls on rapid language switching

fix(H-01): sanitize event.title/detail/date/source in Timeline.render() -- XSS via scraped Neo4j data

fix(C-01,H-03): pre-fill search input with current query; sanitize entity id in not-found XSS

fix(BUG-M9,BUG-C2): pass driver kwarg in run_investigator; update 12->15 investigators

fix(M-06): back button checks referrer before history.back() -- shared/direct links go to search page instead of external site

fix(M-10,M-11,L-06): deterministic fallback node IDs; container-scoped SVG marker IDs; stop D3 simulation on tab switch

fix(M-07): add max 20 retry cap to WebSocket reconnect loops -- prevents infinite background polling when HF Space is sleeping

fix(M-05): cache language labels in applyLanguage() -- avoids redundant API calls on rapid language switching

fix(CodeQL#22,L-02): avoid externally-controlled format string in api.js console.error; strip trailing slash before WebSocket URL construction

fix(H-10): nav active matching requires path===href or path starts with href+'/' -- prevents /search matching /search-results etc

fix(H-09): add hashchange event listener to Router.init() -- direct URL navigation now updates the view

fix(H-02,CodeQL#24): sanitize evidence chip text in FindingItem -- XSS from AI/DB output in innerHTML

fix(C-01,H-03): pre-fill search input with current query; sanitize entity id in not-found message (XSS)

fix(BUG-12): show user-friendly callout when feed is empty due to unpopulated DB instead of swallowing backend message

fix(BUG-11,NEW-A4): add Views.notFound and Router.register('*') -- unknown URLs now show 404 instead of frozen spinner

fix(BUG-9): validate s.url starts with http before injecting into href -- prevents javascript: XSS from DB

fix(BUG-8,BUG-9,BUG-18,NEW-A9): use data-* attrs for entityId in all onclick; fix timeline API to /biography; fix raw URL XSS

fix(BUG-2): replace broken multi-line inline onclick Reset button with GraphRenderer.resetZoom() call

fix(BUG-2,BUG-3,BUG-26,H-07): store _zoomBehavior; add resetZoom() named fn; fix .on('click') closing paren; expand NODE_COLORS/ICONS to 22 types

fix(encoding): strip non-ASCII from 4 remaining files

fix(frontend): H-01+H-02+H-06+H-09+H-11+LOGIC -- navbar, graph, feed fixes

fix(frontend): LOGIC -- 404 route fallback and graph null empty state

fix(encoding): strip non-ASCII chars from all modified files

fix(frontend): BUG-15+16 -- evidence panel comment mismatch and null guard

fix(frontend): BUG-19 -- skeleton group rendered twice in search view

fix(frontend): BUG-18 -- graph container width=0 on tab switch