Fix setDur implicit event, title XSS, hardcoded pulse URL, suppress error toast

- suppressions.html: setDur() now takes explicit element param instead of relying
  on implicit global event.target (which fails outside direct click handlers)
- suppressions.html: removeSuppression() now shows error toast on failed DELETE
- templates/index.html: escape description in title attribute with |e filter
  to prevent attribute breakout on quotes in description text
- diagnose.py: derive Pulse execution URL from pulse_client.url instead of
  hardcoding http://pulse.lotusguild.org

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

diagnose.py

@@ -108,7 +108,8 @@ class DiagnosticsRunner:
 
         pulse_url = None
         if execution_id:
-            pulse_url = f'http://pulse.lotusguild.org/executions/{execution_id}'
+            base = getattr(self.pulse, 'url', '').rstrip('/')
+            pulse_url = f'{base}/executions/{execution_id}' if base else None
 
         return {
             'status': 'done',