Harden browser response boundaries

[parsakhaz]

Summary

• isolate the web fallback Discord window from its opener
• branch on remote-daemon HTTP status before decoding success or error payloads
• separate notebook JSON text formatting from the component's sanitized HTML render paths

Part of #403.

React Doctor

• current-main baseline: 0 errors, 317 warnings, 317 total
• after: 0 errors, 314 warnings, 314 total
• removes window-open-without-noopener, no-fetch-response-used-without-status-check, and the false-positive unsafe-json-in-html finding without replacements

Validation

• pnpm lint
• pnpm typecheck
• pnpm --filter frontend test (245 tests)
• pnpm build (including signed universal DMG/ZIP packaging)
• pnpm dlx [email protected] frontend --no-score --no-supply-chain --no-dead-code --json

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit de82aac.}