Address Codacy static-analysis findings in settings JS

Refactor the two new modules to clear the flagged patterns without any
behavior change:

- Build the search dropdown with DOM nodes + textContent instead of
  innerHTML string concatenation, removing the XSS sinks and the manual
  escapeHtml helper it needed.
- Replace numeric index access (index[i], terms[j], opts[idx],
  currentResults[i]) with array iteration methods, NodeList.item(), and
  Array.prototype.at() to clear detect-object-injection.
- Use === via a shared termsMatch() helper, optional-catch binding, and
  drop a useless initial assignment.

Verified with ESLint (eslint:recommended + eslint-plugin-security) at zero
findings and re-ran the headless-Chromium behavior test (tooltip, per-tab
filter, global search navigation) — all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gZxznuxw8L92FUMBN3Nqz

web_interface/static/v3/js/tooltips.js

@@ -109,11 +109,11 @@
         if (!t) return;
         // Only auto-show on keyboard focus, so a mouse/touch focus does not
         // fight the click handler below.
-        var focusVisible = true;
+        var focusVisible;
         try {
             focusVisible = t.matches(':focus-visible');
-        } catch (err) {
-            focusVisible = true; // older browsers: fall back to always show
+        } catch { // older browsers without :focus-visible
+            focusVisible = true;
         }
         if (focusVisible) show(t);
     });