security(ui): validate URL schemes for Home footer links (same source as #368) #429

Found during the review of #420 (#368, merged). The same Home customization source as #368 has another href sink with no scheme check: footerLinks[].url in public/home.js (~152), rendered as href="${escapeAttr(l.url)}".

Attribute escaping prevents breaking out of the attribute, but a javascript: (or other unsafe-scheme) URL in imported or untrusted customization content would still produce an executable link.

Required work

• Apply the same scheme allowlist and normalisation that fix(ui): escape and validate miniMarkdown link destinations (#368) #420 added for miniMarkdown links (reuse that helper; do not create a second one).
• Render a rejected link as plain escaped text.
• Grep for other href=/src= sinks fed by customization or config content and apply the same check.
• Add red/green tests with hostile schemes (including obfuscated ones) and a safe-link case.