fix(app.js): correct bad escape sequence in search filter button

feat(phase-35): add /forensics page to frontend router

fix(B-06): confirm filter button data-nav-path fix applied + wire addEventListener

fix(B-29): replace misleading 'court-grade PDF' claim with accurate disclaimer

fix(B-15): remove extra brace orphaning else branch in liveFeed ws.onmessage

fix(LOGIC-3): preserve &lang= in search filter buttons and search button handler

fix(SEC-1,CodeQL#24): data-* attrs for connection-map evidence onclick -- prevents single-quote XSS

fix(UI-6): replace corrupted unicode chars in connection map legend with HTML entities

fix(TEXT-1): update hardcoded '12 investigators' to '15' in How It Works and About page

fix(I18N-1,I18N-3): add mni/sat/ks to navbar language dropdown; restore all corrupted Indian script labels in search page dropdown

fix(SEARCH-2,SEARCH-3): add datagov/crimereport filter buttons; add Arabic script U+0600-U+06FF to ALLOWED_CHARS for Urdu/Sindhi search

fix(LOGIC-4): persist language selection to localStorage -- language now survives page refresh

fix(SEC-1,CodeQL#24): sanitize entity name, type, profile.overview k/v, and risk.explanation before innerHTML injection

fix(FEED-1): add pipeline-message guard in liveFeed view -- admin system message no longer shown as fake intelligence

fix(FEED-2): reset connect._retries=0 on each _connectFeedToHome() call -- prevents permanent feed silence after repeated navigation

fix(DUP-1): remove duplicate search input prefill block -- same code appeared twice with different variable names

fix(JS-1 CRITICAL): remove 2 duplicate const _langLabelCache declarations -- caused SyntaxError crash in strict-mode browsers

fix(SyntaxError): move _stats_cache vars to module level; global declaration must precede use -- fixes CI SyntaxError on line 142

fix(M-05): cache language labels in applyLanguage() -- avoids redundant API calls on rapid language switching

fix(M-05): cache language labels in applyLanguage() -- avoids redundant API calls on rapid language switching

fix(C-01,H-03): pre-fill search input with current query; sanitize entity id in not-found XSS

fix(BUG-M9,BUG-C2): pass driver kwarg in run_investigator; update 12->15 investigators

fix(M-06): back button checks referrer before history.back() -- shared/direct links go to search page instead of external site

fix(M-10,M-11,L-06): deterministic fallback node IDs; container-scoped SVG marker IDs; stop D3 simulation on tab switch

fix(M-07): add max 20 retry cap to WebSocket reconnect loops -- prevents infinite background polling when HF Space is sleeping

fix(M-05): cache language labels in applyLanguage() -- avoids redundant API calls on rapid language switching

fix(C-01,H-03): pre-fill search input with current query; sanitize entity id in not-found message (XSS)

fix(BUG-12): show user-friendly callout when feed is empty due to unpopulated DB instead of swallowing backend message

fix(BUG-11,NEW-A4): add Views.notFound and Router.register('*') -- unknown URLs now show 404 instead of frozen spinner

fix(BUG-9): validate s.url starts with http before injecting into href -- prevents javascript: XSS from DB

fix(BUG-2): replace broken multi-line inline onclick Reset button with GraphRenderer.resetZoom() call

fix(frontend): H-01+H-02+H-06+H-09+H-11+LOGIC -- navbar, graph, feed fixes

fix(encoding): strip non-ASCII chars from all modified files

fix(frontend): BUG-19 -- skeleton group rendered twice in search view

fix(frontend): BUG-23 -- sanitize() corrupted entity IDs in path-finder

fix(frontend): BUG-13+14 -- XSS in search and filter button onclick

fix(frontend): BUG-3+4+20 -- live feed reconnect, real data, onerror

fix(frontend): BUG-6/12/16/20 — WS reconnect, encode, skeleton, lang

fix(BUG-02/10/11/25): health retry with backoff; duplicate id removed; language selectors synced; fixed error message

fix(BUG-10/11/14): full DOM translation via data-i18n; sanitize search error message

feat(i18n): wire applyLanguage() to selector — updates placeholder, tagline, result messages

fix: loading screen — remove invalid ` and ${ from app.js, bump SW cache

feat(update): evidence panel 4-tabs, connection map, language selector, API root route, 575-source CSV

fix(frontend): Router.init, D3 onerror, expanded search filters

Merge branch 'main' into fix/codeql-all-security-fixes

fix(security): sanitize user input before innerHTML insertion — CodeQL alerts 17-19

fix(security): sanitize user-controlled strings before innerHTML insertion

fix(search+multilingual+sources): global search, fulltext index, sources API

fix(search+graph+frontend): 6 issues resolved

feat(frontend): patriotic HTML/CSS/JS dashboard with component architecture