fix(security): resolve code-scanning + dependency alerts

[sathyaprakash000]

What & why

Handling the open code-scanning (CodeQL) and Dependabot alerts.

Fixed (real)

• Reflected XSS — webhook.js (js/reflected-xss): the Meta verify handler echoed hub.challenge via res.send() (defaults to text/html). Now sent as text/plain, so the reflected value can't be interpreted as HTML. (Meta's challenge is numeric; only echoed after a verify-token match.)
• DOM XSS — WhatsAppPreview.jsx (js/xss-through-dom): the template-builder preview link used the admin's typed URL directly as href. Now only http(s) URLs are allowed, neutralising a javascript: scheme.
• Vulnerable uuid (Dependabot + npm audit): exceljs@4.4.0 pulled uuid@8.3.2 (GHSA buffer-bounds, <11.1.1). Added an npm overrides forcing uuid ^11.1.1. Verified exceljs still writes valid xlsx with uuid 11; npm audit (backend) now reports 0 vulnerabilities.

Already fixed earlier — will auto-close on the next CodeQL scan of main

• js/insecure-randomness in users.js (×2) — fixed in fix(security): CSPRNG password gen + gate /uploads behind auth (P1 lows) #15 (crypto.randomInt)
• js/clear-text-logging of admin password — fixed in fix(security,config): harden secret guards, scrub Caddyfile, fix deploy docs (Batch D) #5 (written to 0600 file, not logged)

False positives / accepted (will dismiss with reasons after merge)

• ChatWindow.jsx <img/video src> — the src is a blob: URL from URL.createObjectURL (not untrusted HTML).
• auth.js "clear-text storage" of the JWT — a JWT in an httpOnly cookie is the intended session mechanism.
• index.js cookie CSRF — mitigated by sameSite: 'strict' (cookie not sent cross-site).

Verification

• node --check ✓; backend npm test 20/20 ✓; frontend build ✓ + test:unit 51/51 ✓
• backend npm audit → 0 vulnerabilities