Fix XSS: escape table data and sanitize sort/pagination URL params

- htmlspecialchars() on category, type, status in table rows
- htmlspecialchars() on data-status attributes in quick-action buttons
- Restrict $currentDir to 'asc'|'desc' to prevent class injection
- htmlspecialchars() on all http_build_query URLs in pagination and sort headers
- htmlspecialchars() on AuditLogView pagination URLs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

views/admin/AuditLogView.php

@@ -149,7 +149,7 @@ $nonce = SecurityHeadersMiddleware::getNonce();
                     for ($i = 1; $i <= min($totalPages, 10); $i++) {
                         $params['page'] = $i;
                         $activeClass = ($i == $page) ? 'active' : '';
-                        $url = '?' . http_build_query($params);
+                        $url = htmlspecialchars('?' . http_build_query($params), ENT_QUOTES, 'UTF-8');
                         echo "<a href='$url' class='btn btn-small $activeClass'>$i</a> ";
                     }
                     if ($totalPages > 10) {