fix: backend+frontend full audit - 15 bugs fixed across all files

public/js/pages/home.js

@@ -50,7 +50,7 @@ const HomePage = {
           </tr></thead><tbody>${tickets.map(tick => `
             <tr><td>${tick.id}</td><td>${U.badge(tick.type,'type')}</td><td>${U.esc(tick.title)}</td>
             <td>${U.badge(tick.status,'status')}</td><td>${U.date(tick.created_at)}</td>
-            <td><button class="btn btn-o btn-sm" onclick="App.navigate('home','tracking');HomePage.showTrackDetail(${tick.id},'${token}')">查看</button></td></tr>
+            <td><button class="btn btn-o btn-sm" onclick="App.navigate('home','tracking');HomePage.showTrackDetail(${tick.id},'${U.escJs(token)}')">查看</button></td></tr>
           `).join('')}</tbody></table></div>` : '<div class="empty"><i class="fas fa-inbox"></i><p>未找到工单</p></div>';
       } catch (ex) { ct.innerHTML = `<div class="alert alert-e">${ex.message}</div>`; }
     };