Phase 5: XSS-omission lint + DOM-leak watch (2 commits)
Frontend extracted into 8 modules; backend hardened; mirrors automated