Fix dashboard XSS, credential exposure, auth race, and URL crash (#252)

[boot-coco]

Summary

• Stored XSS via javascript: URL: Validate URL scheme (https?://) before window.open() in both renderTopPages and loadItemsList click handlers
• Credential exposure in auth table: Mask credential values in settings display, showing only •••• + last 4 characters instead of full plaintext
• Double-fetch auth with wrong property names: Second getAuthFromExtension() call used extAuth.authToken/extAuth.authUser but the function returns { token, user } — fixed to use correct names
• new URL() crash on malformed source_url: Wrapped in try/catch with fallback to raw substring for display

Closes #252

Codex Review

Pending — requesting review.

Test plan

• Load dashboard with a source_url containing javascript:alert(1) — verify it does NOT open
• Check auth settings table — credentials should display as token: ••••xxxx
• Test extension auth sync flow — verify login succeeds on first attempt without double-fetch mismatch
• Add an item with a malformed source_url (e.g., not-a-url) — verify items list renders without crash

🤖 Generated with Claude Code

[jessie-coco]

Codex Review R1: CLEAN

0 P1 + 0 P2 + 0 P3 — all four fixes verified correct.

Fix Verification

#	Fix	Verdict
1	Stored XSS via javascript: URL — renderTopPages (L253) and loadItemsList (L300) now gate window.open() behind /^https?:\/\//i	✅ Correct — blocks all non-HTTP schemes
2	Credential masking — renderAuthsTable now shows •••• + last 4 chars instead of plaintext	✅ Correct — output also passes through escHtml()
3	Auth property name mismatch — second getAuthFromExtension() call (L53) fixed from extAuth.authToken/extAuth.authUser to extAuth.token/extAuth.user, matching the first call (L29) and the function's return contract	✅ Correct
4	new URL() crash on malformed source_url — wrapped in try/catch with substring(0, 40) fallback	✅ Correct

Observations (pre-existing, not blocking)

• d.external_url at L206 is set as an href with only escHtml() — this prevents attribute breakout but does not block javascript: scheme. Not introduced by this PR, but worth a follow-up issue if dispatch URLs can be user-controlled.
• d.status at L210 is injected into innerHTML unescaped — safe only if server-controlled. Also pre-existing.

Result: APPROVE — clean fix, no regressions introduced.