chore(web): CI cleanup — declare debugLog global, fix entity-unescape order, drop v3 from UI branding

- Add debugLog to the /* global */ headers of the six JS files that call it
  (defined in base.html's first inline script) — resolves the wall of
  "'debugLog' is not defined" ESLint errors failing the Codacy check.
- Fix the two js/double-escaping CodeQL alerts in app-shell.js: the
  entity-unescape chains decoded & before </>, so a value
  containing a pre-escaped "&amp;lt;" wrongly double-decoded to "<".
  &amp; now decodes last (standard order). Pre-existing bug, made visible
  when the inline scripts moved into scannable .js files.
- Page title / header drop the "- v3" suffix, matching the de-versioned
  user-facing URL.

The remaining 7 CodeQL alerts are pre-existing patterns newly visible to
scanning (CodeQL doesn't see inline template JS): 4 github.com/htmx.org
URL-substring checks (the htmx ones match error-message text, not URLs —
false positives in context) and 1 innerHTML XSS-through-DOM in the GitHub
install flow. Triage/fix deferred to a focused follow-up rather than
expanding this PR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ

web_interface/static/v3/app.js

@@ -1,4 +1,4 @@
-/* global showNotification, updateSystemStats, updateDisplayPreview, htmx */
+/* global showNotification, updateSystemStats, updateDisplayPreview, htmx, debugLog */
 // LED Matrix v3 JavaScript
 // Additional helpers for HTMX and Alpine.js integration
 

web_interface/static/v3/js/app-early.js

@@ -1,3 +1,4 @@
+/* global debugLog */
 // Early helpers and the app() stub (must run before Alpine init)
 // Extracted from templates/v3/base.html so browsers cache it as a static asset.
         // Helper function to get installed plugins with fallback

web_interface/static/v3/js/app-shell.js

@@ -1,3 +1,4 @@
+/* global debugLog */
 // SSE wiring + full Alpine app() implementation and tab logic
 // Extracted from templates/v3/base.html so browsers cache it as a static asset.
         // Assign to window so reconnectSSE() in app.js can reach them.
@@ -1480,9 +1481,9 @@
                                             unescapedValue = value
                                                 .replace(/"/g, '"')
                                                 .replace(/'/g, "'")
-                                                .replace(/&/g, '&')
                                                 .replace(/&lt;/g, '<')
-                                                .replace(/&gt;/g, '>');
+                                                .replace(/&gt;/g, '>')
+                                                .replace(/&amp;/g, '&');
                                         }
                                         
                                         // Try to parse as JSON
@@ -2253,9 +2254,9 @@
                                     unescapedValue = value
                                         .replace(/&quot;/g, '"')
                                         .replace(/&#39;/g, "'")
-                                        .replace(/&amp;/g, '&')
                                         .replace(/&lt;/g, '<')
-                                        .replace(/&gt;/g, '>');
+                                        .replace(/&gt;/g, '>')
+                                        .replace(/&amp;/g, '&');
                                 }
                                 
                                 try {

web_interface/static/v3/js/custom-feeds-helpers.js

@@ -1,3 +1,4 @@
+/* global debugLog */
 // Custom feeds table helper functions
 // Extracted from templates/v3/base.html so browsers cache it as a static asset.
         function addCustomFeedRow(fieldId, fullKey, maxItems, pluginId) {

web_interface/static/v3/js/htmx-config.js

@@ -1,3 +1,4 @@
+/* global debugLog */
 // HTMX swap/script-execution configuration and section toggle helpers
 // Extracted from templates/v3/base.html so browsers cache it as a static asset.
         // Configure HTMX to evaluate scripts in swapped content and fix insertBefore errors

web_interface/static/v3/plugins_manager.js

@@ -1,3 +1,4 @@
+/* global debugLog */
 // ─── LocalStorage Safety Wrappers ────────────────────────────────────────────
 // Handles environments where localStorage is unavailable or restricted (private browsing, etc.)
 const safeLocalStorage = {

web_interface/templates/v3/base.html

@@ -3,7 +3,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>LED Matrix Control Panel - v3</title>
+    <title>LED Matrix Control Panel</title>
 
     <!-- Debug logging gate: verbose console output is suppressed unless
          localStorage.pluginDebug === 'true' (the same switch the plugin
@@ -302,7 +302,7 @@
                     </button>
                     <h1 class="text-xl font-bold text-gray-900">
                         <i class="fas fa-tv text-blue-600 mr-2"></i>
-                        LED Matrix Control - v3
+                        LED Matrix Control
                     </h1>
                 </div>