Fix 7 frontend security vulnerabilities (4 critical, 3 high)

- Escape all innerHTML assignments with user/external data across 12 JS files
- Upgrade credential encryption: per-value IV, key moved to sessionStorage
- Fix open redirect in TOTP auth via proper URL hostname validation
- Remove sensitive DNS topology data from localStorage cache
- Add security regression test suite (51 tests)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

status/js/weather.js

@@ -163,7 +163,7 @@
         weatherWidget.temp.textContent = `${weather.temp}${tempSuffix}`;
         weatherWidget.condition.textContent = weather.condition;
         weatherWidget.wind.textContent = `Wind: ${weather.windSpeed} ${windLabel} ${weather.windDir}`;
-        weatherWidget.icon.innerHTML = `<span class="weather-emoji">${weather.icon}</span>`;
+        weatherWidget.icon.innerHTML = `<span class="weather-emoji">${escapeHtml(weather.icon)}</span>`;
       }
     } catch (error) {
       console.error('Weather update error:', error);