Fix setDur implicit event, title XSS, hardcoded pulse URL, suppress error toast

- suppressions.html: setDur() now takes explicit element param instead of relying
  on implicit global event.target (which fails outside direct click handlers)
- suppressions.html: removeSuppression() now shows error toast on failed DELETE
- templates/index.html: escape description in title attribute with |e filter
  to prevent attribute breakout on quotes in description text
- diagnose.py: derive Pulse execution URL from pulse_client.url instead of
  hardcoding http://pulse.lotusguild.org

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

templates/index.html

@@ -214,7 +214,7 @@
             <td>{{ e.event_type | replace('_', ' ') }}</td>
             <td><strong>{{ e.target_name }}</strong></td>
             <td>{{ e.target_detail or '–' }}</td>
-            <td class="desc-cell" title="{{ e.description }}">{{ e.description | truncate(60) }}</td>
+            <td class="desc-cell" title="{{ e.description | e }}">{{ e.description | truncate(60) }}</td>
             <td class="ts-cell">{{ e.first_seen }}</td>
             <td>{{ e.consecutive_failures }}</td>
             <td>