refactor: address Sonar quality findings

[aksOps]

Summary

• resolve 49 live Sonar maintainability and reliability findings in code
• decompose startup reconciliation, modal rendering, markdown parsing, and CI monitor dispatch
• replace the unsafe inline-markdown matcher with bounded patterns and a long-input regression test
• preserve 66 accepted-by-design findings in Sonar with explicit rationale

Root cause

Several production and test paths had accumulated control-flow complexity, duplicated selectors, and analyzer-hostile idioms. The inline-markdown tokenizer also used one combined expression with super-linear backtracking risk.

Validation

• npm test: 933 tests passed; 98.35% statements, 95.28% branches, 98.81% functions, 99.47% lines
• npm run coverage:go: 97.8% statement coverage
• go vet ./...: passed
• go test -race ./... -count=1: 938 tests passed
• npm run build: passed
• Go format and CI monitor/checker script suites: passed
• browser smoke: sign-in, board load, task create/edit/save, checklist, emoji, blocked state, settings/debug overlay; no page errors

Sonar note

Local Agentic Analysis is unavailable for this organization (HTTP 403). The normal PR Sonar scan is the authoritative fresh analysis.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
97.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud