fix: escapeHtml does not escape single quotes — XSS in onclick attributes

[deucebucket]

Bug

In static/js/common.js (~lines 11-16), the DOM-based escapeHtml() escapes &, <, >, and " but NOT single quotes. Throughout the codebase, escaped output is injected into single-quoted JavaScript strings inside onclick attributes:

• library.html:574 — editBook with author/title
• library.html:599,603 — orphan onclick handlers
• settings.html:2831,3213,3242 — plugin management handlers

A book author like O'Brien breaks the JS string. With attacker-controlled metadata, this is an XSS vector.

Fix

Add single-quote escaping to escapeHtml().

Severity

Critical — functional breakage on common names + XSS potential.

Found via UI flow audit.

[deucebucket]

Implemented on main by commit 5fc7ba6: escapeHtml now escapes all five relevant HTML characters, including single quotes.