v3.1 — Full-Stack Security Audit & Polish

What's New

Security Hardening

• DOMPurify wired to all innerHTML injection points (terminal, GitHub dashboard, admin panel, desktop, modal)
• SRI hash on DOMPurify CDN script tag
• 6 security headers via Vercel: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• CSS injection prevention in wallpaper URL handler
• JSON import validation with schema checks for admin backup/restore
• Admin panel hidden from visitor UI (console-only for developer)
• Service worker validates res.ok before caching

Performance

• State decoupled from visual modules via CustomEvent observer pattern
• Animation loops pause when tab hidden — aurora (~24fps), fx (~30fps), skills, mahoraga wheel
• Lazy loading for SkillsUniverse, GitHub, Terminal (only fetched when window opens)
• Google Fonts trimmed: 6 families/18 weights → 5 families/12 weights (~200KB saved)
• CSS cache busting on all 14 stylesheets

Accessibility & UX

• aria-live regions for screen reader window open/close announcements
• Focus trapping in modal, login, welcome, and tour overlays
• Skip-link for keyboard users
• ESC key priority: modal > lightbox > tour > window
• Mobile touch targets bumped to 44px minimum (WCAG)
• Missing CSS variables defined (--neon-pink, --neon-orange)
• Reduced-motion queries deduplicated

Code Quality

• 27 smoke tests via vitest (Sanitize + State modules)
• Window onClose callback for cleanup (RAF cancellation)
• 17 dead files deleted
• Dead imports cleaned from main.js

40 files changed — 1,681 insertions, 751 deletions