fix(web): close the UI follow-ups from #456

[dubadub]

Fixes the eight follow-ups listed in #456, one commit each.

• Recipes index: server sort order differs from the client sorter #486 The recipes index is sorted naturally on the server (case-folded, digit runs by value), so the no-JS order matches what the browser produces. The client no longer re-sorts on load for the default sort, so there is no reorder on first paint. Accents are not folded server-side; that divergence is documented and pinned by a test.
• Server-mode search results interpolate recipe names into innerHTML unescaped #487 The server-mode search results escape recipe names and paths before insertion into innerHTML, matching search.js. A test injects a fabricated result and asserts nothing executes.
• Icon-button aria-labels are hard-coded English #488 Icon-button labels ("Toggle theme", "Dismiss", "Increase scale", …) come from eight new aria-* keys in all seven locales; the shortcuts modal reads its close label from window.__STRINGS__.
• Shopping list: Clear All hides the results container and never shows it again #489 Clear All no longer hides the shopping-list results container, so the empty state shows and live updates render into a visible element.
• Editor syntax-highlight colours are raw hex and not theme-aware #490 Editor syntax colours are CSS classes on tokens (.cm-cook-* in input.css) instead of hex literals in editor.js, so they flip with the theme.
• Editor fires an autosave immediately on open #491 The editor showed "Saved" on open because of an unconditional status call, not an autosave; the call is removed and a test asserts no PUT and an unchanged mtime.
• Heading levels skip on the API docs page and in sectioned recipes #492 API docs endpoint summaries are h3 and sectioned recipes' step headings are h2, so no page skips a heading level.
• Static site build copies stylesheet sources next to output.css #493 The static-site build ships only compiled assets: input.css, components.css and static/js/src/ are excluded.

Verification

• cargo fmt, cargo clippy --all-targets, cargo test clean.
• Playwright (Chromium, serial): 146 passed, 5 pre-existing skips, 0 failed.
• Static build checked: 19 assets, no stylesheet sources.

Filed while reviewing

• Editor: multi-line block comments swallow the rest of the recipe #494 multi-line block comments swallow the rest of the recipe in the editor.
• Editor: quantities inside {} are not highlighted #495 quantities inside {} are not highlighted.

Closes #486, closes #487, closes #488, closes #489, closes #490, closes #491, closes #492, closes #493.

https://claude.ai/code/session_013urND2B6Y3Z7WQuDpE8ZDu

[claude]

Review of #496

Nice work — this is a well-organized PR: each of the eight follow-ups from #456 is a focused, isolated commit with its own test, and the descriptions make it easy to verify each fix independently. I read through the full diff (locales, src/build/writer.rs, src/web/builders.rs, templates, JS, and the new/updated Playwright specs). I couldn't execute cargo build/cargo test/Playwright myself in this sandbox, so the notes below are from static reading only — the verification steps in the PR description (fmt/clippy/test clean, 146 Playwright passing) cover what I can't run here.

Correctness

• natural_cmp/natural_key (Recipes index: server sort order differs from the client sorter #486, src/web/builders.rs) — solid implementation, and the test coverage is thorough (digit runs, case folding, accents, tie-breaking, directory-first ordering). The u128::MAX cap on digit-run overflow is a reasonable defensive choice for a pathological input. Good call documenting the accent-folding divergence from Intl.Collator with a pinning test rather than silently diverging.
• is_shipped_asset (Static site build copies stylesheet sources next to output.css #493, src/build/writer.rs) — verified by cross-checking that output.css and editor.bundle.js (the only two static assets templates actually reference) survive the filter, while css/input.css, css/components.css, and js/src/* are excluded. The prefix-based matching is simple and correct for the current file set.
• Search XSS fix (Server-mode search results interpolate recipe names into innerHTML unescaped #487) — confirmed the new escapeHtml in base.html mirrors the existing one in static/js/search.js, so both the client-rendered and server-mode search paths now escape consistently. The injected-markup Playwright test is a good regression guard.
• Editor autosave-on-open fix (Editor fires an autosave immediately on open #491) — removing the unconditional updateSaveStatus('saved') call on load is a clean fix, and the new test asserting no PUT request + unchanged mtime is exactly the right way to pin this.
• Heading hierarchy (Heading levels skip on the API docs page and in sectioned recipes #492) — checked the full heading structure in api_docs.html (h1→h2→h3→h4) and recipe.html (h1→h2 siblings for Ingredients/Cookware/step-sections) — no skipped levels introduced.
• Shopping list Clear All (Shopping list: Clear All hides the results container and never shows it again #489) — the container is never hidden by default and displayShoppingList() now unconditionally un-hides it on every render, so this is a safe, minimal fix rather than a patch that only works for the one call site.

Minor / nitpicks (non-blocking)

1. Duplicated HTML-escaping logic: static/js/keyboard-shortcuts.js defines its own inline escape (.replace(/&/g,...)...) instead of reusing the escapeHtml() already defined in base.html (templates/base.html:402). Since keyboard-shortcuts.js is loaded via a <script> tag after that inline script runs, the global escapeHtml function is already available on window at call time — the duplication could be dropped. Very low risk either way since it's static translation strings being escaped, not attacker-controlled input.
2. aria-close vs aria-dismiss: both translate to essentially "Close"/"Dismiss" in every locale and are used for conceptually similar close/dismiss icon buttons. Not a bug, just a slight naming overlap that could be consolidated to one key if you want to trim the locale files later.
3. The new EXCLUDED_STATIC_PREFIXES list is a hardcoded prefix list rather than something derived from what templates actually reference — fine for the current small set of assets, but worth remembering to update if new unbundled source files are added under static/ (the added test is_shipped_asset_excludes_sources_only will catch drift only if someone remembers to extend it too).

Security

• The Server-mode search results interpolate recipe names into innerHTML unescaped #487 fix directly addresses a real XSS-shaped bug (unescaped innerHTML interpolation of API response data). The fix and test look correct.
• No other security concerns spotted — the aria-label/i18n changes and static-asset exclusion are not security-sensitive.

Test coverage

Good coverage overall — each behavioral fix (#486, #487, #489, #491, #493) has a corresponding unit or e2e test. #488 (aria-label i18n) and #490/#492 (CSS/heading-level changes) are lower-risk template/CSS tweaks and reasonably left without dedicated new tests, though a quick a11y-focused Playwright assertion (e.g., checking aria-label is non-empty/localized on the icon buttons) could be a nice future addition given the existing accessibility.spec.ts suite.

Overall: looks ready to merge pending your own fmt/clippy/test run confirmation. Nice attention to detail on tying each fix back to a regression test.