fix(web): resolve Codacy findings — DOM building over innerHTML, Map callbacks, misc lint

Verified each of the 27 reported findings against current code; all fixed
except one rule class skipped with reason below.

- app-early.js: plugin tab buttons are now built with createElement/
  createTextNode instead of innerHTML template strings (icon class and name
  come from plugin manifests - semi-trusted input; the old code escaped the
  name but interpolated the icon class). Both construction sites. Also the
  forEach arrow no longer returns tab.remove()'s value.
- plugin-order-list.js: rows, empty state, and error state all built with
  DOM APIs - the file no longer contains innerHTML at all (the now-unneeded
  escapeHtml/escapeAttr helpers are removed); MODE_LABELS is a Map so the
  vegas-mode lookup can't hit prototype properties.
- notification.js: actionCallbacks is a Map (get/set/delete) instead of a
  plain object - resolves the object-injection-sink and dynamic-delete
  findings; triggerAction also type-checks the callback.
- htmx-config.js: unused catch binding dropped; var -> const in the
  afterSettle handler; the swapped-<script> re-execution reads/writes
  textContent instead of innerHTML; the diagnostic form payload uses a
  null-prototype object so a field named __proto__ can't pollute.
- custom-feeds-helpers.js DELETED (with its script tag): all three of its
  functions (addCustomFeedRow, removeCustomFeedRow,
  handleCustomFeedLogoUpload) are shadowed by the deferred
  widgets/custom-feeds.js window assignments, which always win at call time
  - the copies were dead even when they lived inline in base.html. This
  also resolves the unused-function and unused-variable findings there.

Skipped: 4x "Non-serializable expression must be wrapped with $(...)" in
app-early.js - that rule targets code crossing a browser-automation
serialization boundary (e.g. page.evaluate); these are ordinary arrow
functions in plain browser code with no such boundary.

Validation: all 40 web tests pass (incl. the static-asset reference audit,
which confirms no template still points at the deleted file); Jinja parse OK.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ

web_interface/static/v3/js/htmx-config.js

@@ -133,7 +133,7 @@
                         // For form submissions, log the form data
                         if (target && target.tagName === 'FORM') {
                             const formData = new FormData(target);
-                            const formPayload = {};
+                            const formPayload = Object.create(null);
                             for (const [key, value] of formData.entries()) {
                                 formPayload[key] = value;
                             }
@@ -149,7 +149,7 @@
                                         validation_errors: errorData.validation_errors,
                                         context: errorData.context
                                     });
-                                } catch (e) {
+                                } catch {
                                     console.error('Error response (non-JSON):', xhr.responseText.substring(0, 500));
                                 }
                             }
@@ -167,11 +167,11 @@
                                 const scripts = event.detail.target.querySelectorAll('script');
                                 scripts.forEach(function(oldScript) {
                                     try {
-                                        if (oldScript.innerHTML.trim() || oldScript.src) {
+                                        if (oldScript.textContent.trim() || oldScript.src) {
                                             const newScript = document.createElement('script');
                                             if (oldScript.src) newScript.src = oldScript.src;
                                             if (oldScript.type) newScript.type = oldScript.type;
-                                            if (oldScript.innerHTML) newScript.textContent = oldScript.innerHTML;
+                                            if (oldScript.textContent) newScript.textContent = oldScript.textContent;
                                             if (oldScript.parentNode) {
                                                 oldScript.parentNode.insertBefore(newScript, oldScript);
                                                 oldScript.parentNode.removeChild(oldScript);
@@ -195,8 +195,8 @@
                     // containers only) so modals and plugin config panels can still reload.
                     document.body.addEventListener('htmx:afterSettle', function(event) {
                         if (event.detail && event.detail.target) {
-                            var target = event.detail.target;
-                            var trigger = target.getAttribute('hx-trigger') || '';
+                            const target = event.detail.target;
+                            const trigger = target.getAttribute('hx-trigger') || '';
                             if (trigger.includes('loadtab')) {
                                 target.setAttribute('data-loaded', 'true');
                             }