fix: clear every open Sonar security issue, and half the reliability ones (#2037)

* fix(security): mint idempotency keys properly, and resolve the extractor by path

Three findings out of a sweep of every open Sonar security issue. The other 49
turned out to be false positives and are documented in sonar-project.properties
rather than changed — each entry scoped to a file, never a whole rule, so a
future Math.random() on an auth path still fails.

The idempotency key is the one that can lose data. Both producers fell back to
Math.random when crypto.randomUUID was missing, and randomUUID needs a secure
context — TREK's own quickstart is http://localhost:3000 and LAN installs run on
http://192.168.x.x, so on the deployments the README documents the fallback is
what actually runs. The axios one was
`Math.random().toString(36).slice(2)`, which is not length-stable: 0.5 yields a
single character and 0 yields the empty string, which the interceptor reads as
"no key" and skips deduplication for entirely. Two writes sharing a key collapse
into one — the second gets the first one's cached response and the edit is gone
with no error anywhere. Both now come from utils/randomId, which has the
getRandomValues rung that works in insecure contexts too.

The extractor probe stored the bare binary name, so every extraction re-resolved
it through whatever PATH held at that moment. The official image sets
KITINERARY_EXTRACTOR_PATH and never reaches that branch, but a bare-metal install
without it ran an unqualified name from a PATH it does not control. It now walks
the search path itself and keeps the absolute path of the file it verified;
execFileSync also drops the /bin/sh hop the old probe needed. PATH comes through
app-config because process.env is walled off in src/.

* fix: four tests and sorts that were not doing what they claimed

Sonar reported 43 high-impact reliability issues. Reading all of them, four are
real; the rest are cosmetic or would be made worse by the suggested change.

budget.test.ts hand-built `paid: true`, but both emitters send `paid: body.paid
? 1 : 0` and the handler stores the value verbatim — the test asserted a payload
the server never sends. The line below it already used a number.

admin.controller.test.ts had a `.resolves` assertion with no await. The promise
was dropped, so that line could not fail the test.

The two to-do category lists sorted with a bare .sort(), which is byte order:
every accented name files behind the whole ASCII range, so in a German trip
"Übernachtung" lands after "Zelt". TREK ships 23 locales, so this is real data.
One side effect worth knowing: katColor picks a category's dot colour by its
index, so re-sorting can move which category shows which colour — it already
moves whenever a category is added, and the colour carries no meaning.

Deliberately not changed: the two `| 0` truncations (Math.trunc is not
equivalent — `| 0` wraps at 32 bits and these carry millisecond timestamps), the
two .map() callbacks whose second parameter is declared and used, and the sha1
in thumbnail.service (its own comment says a swap would orphan every existing
thumbnail).

* refactor: give every button a type, and prefer the Number statics

Two mechanical sweeps, no behaviour change intended in either.

A <button> with no type attribute is type="submit" per the HTML spec. Outside a
form that does nothing today, but it turns into a surprise the moment the markup
is wrapped in one, which is what Sonar's S9011 is warning about. 870 buttons get
an explicit type="button". Two things were left alone on purpose: buttons that
take a {...spread}, because the spread may carry a type and the merge order
decides which wins, and anything inside a <form> — there the answer is a
judgement call, and checking all eleven form files found every real submit button
already carrying type="submit".

The Number sweep covers only the three globals that are exactly equivalent to
their Number twin: parseInt, parseFloat and NaN. isNaN is NOT in it — the global
coerces its argument, so isNaN('abc') is true where Number.isNaN('abc') is false,
and renaming it would change what the code does. It reaches server and plugin-sdk
as well as the client; both copies of egress-policy.ts got the identical edit, so
the mirror the SDK's parity test guards stays intact.

client/src/pages/admin/AdminNotificationsPanel.tsx

@@ -93,7 +93,7 @@ export default function AdminNotificationsPanel({ t, toast }: { t: (k: string) =
                   const isOn = matrix.preferences[eventType]?.[ch] ?? true
                   return (
                     <div key={ch} style={{ display: 'flex', justifyContent: 'center' }}>
-                      <button
+                      <button type="button"
                         onClick={() => toggle(eventType, ch)}
                         className={`relative inline-flex h-5 w-9 items-center rounded-full transition-colors flex-shrink-0 ${isOn ? 'bg-content' : 'bg-edge'}`}
                       >

client/src/pages/admin/AdminNotificationsTab.tsx

@@ -69,7 +69,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             <h2 className="font-semibold text-slate-900">{t('admin.notifications.emailPanel.title')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.smtp.hint')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setChannels(!emailActive, webhookActive, ntfyActive)}
             className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors flex-shrink-0 ${emailActive ? 'bg-content' : 'bg-edge'}`}
           >
@@ -112,11 +112,11 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
           </div>
         </div>
         <div className="px-6 pb-4 flex items-center gap-2 border-t border-slate-100 pt-4">
-          <button onClick={saveNotifications}
+          <button type="button" onClick={saveNotifications}
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm font-medium hover:bg-slate-800 transition-colors">
             <Save className="w-4 h-4" />{t('common.save')}
           </button>
-          <button
+          <button type="button"
             onClick={async () => {
               const smtpKeys = ['smtp_host', 'smtp_port', 'smtp_user', 'smtp_pass', 'smtp_from', 'smtp_skip_tls_verify']
               const payload: Record<string, string> = {}
@@ -144,7 +144,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             <h2 className="font-semibold text-slate-900">{t('admin.notifications.webhookPanel.title')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.webhook.hint')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setChannels(emailActive, !webhookActive, ntfyActive)}
             className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors flex-shrink-0 ${webhookActive ? 'bg-content' : 'bg-edge'}`}
           >
@@ -161,7 +161,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             <h2 className="font-semibold text-slate-900">{t('admin.notifications.ntfy')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.ntfy.hint') || 'Allow users to configure their own ntfy topics for push notifications.'}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setChannels(emailActive, webhookActive, !ntfyActive)}
             className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors flex-shrink-0 ${ntfyActive ? 'bg-content' : 'bg-edge'}`}
           >
@@ -240,7 +240,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
           )}
         </div>
         <div className="px-6 pb-4 flex items-center gap-2 border-t border-slate-100 pt-4">
-          <button
+          <button type="button"
             onClick={async () => {
               try {
                 await authApi.updateAppSettings({ admin_webhook_url: smtpValues.admin_webhook_url || '' })
@@ -250,7 +250,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm font-medium hover:bg-slate-800 transition-colors">
             <Save className="w-4 h-4" />{t('common.save')}
           </button>
-          <button
+          <button type="button"
             onClick={async () => {
               // A masked value means the URL only lives on the server — send no url and let
               // the server test the stored one instead of pre-saving the mask.
@@ -331,7 +331,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
           )}
         </div>
         <div className="px-6 pb-4 flex items-center gap-2 border-t border-slate-100 pt-4">
-          <button
+          <button type="button"
             onClick={async () => {
               try {
                 await authApi.updateAppSettings({
@@ -347,7 +347,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm font-medium hover:bg-slate-800 transition-colors">
             <Save className="w-4 h-4" />{t('common.save')}
           </button>
-          <button
+          <button type="button"
             onClick={async () => {
               const topic = smtpValues.admin_ntfy_topic?.trim()
               if (!topic) return

client/src/pages/admin/AdminSettingsTab.tsx

@@ -54,7 +54,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               <p className="text-sm font-medium text-slate-700">{t('admin.passwordLogin')}</p>
               <p className="text-xs text-slate-400 mt-0.5">{t('admin.passwordLoginHint')}</p>
             </div>
-            <button
+            <button type="button"
               disabled={envOverrideOidcOnly || (!passwordLogin && !oidcLogin)}
               onClick={() => handleToggleAuthSetting('password_login', !passwordLogin, setPasswordLogin)}
               title={!passwordLogin && !oidcLogin ? t('admin.lockoutWarning') : undefined}
@@ -72,7 +72,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               <p className="text-sm font-medium text-slate-700">{t('admin.passwordRegistration')}</p>
               <p className="text-xs text-slate-400 mt-0.5">{t('admin.passwordRegistrationHint')}</p>
             </div>
-            <button
+            <button type="button"
               disabled={envOverrideOidcOnly}
               onClick={() => handleToggleAuthSetting('password_registration', !passwordRegistration, setPasswordRegistration)}
               className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors disabled:opacity-50 ${passwordRegistration ? 'bg-content' : 'bg-edge'}`}
@@ -90,7 +90,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
                 <p className="text-sm font-medium text-slate-700">{t('admin.oidcLogin')}</p>
                 <p className="text-xs text-slate-400 mt-0.5">{t('admin.oidcLoginHint')}</p>
               </div>
-              <button
+              <button type="button"
                 disabled={!passwordLogin && oidcLogin}
                 onClick={() => handleToggleAuthSetting('oidc_login', !oidcLogin, setOidcLogin)}
                 title={!passwordLogin && oidcLogin ? t('admin.lockoutWarning') : undefined}
@@ -110,7 +110,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
                 <p className="text-sm font-medium text-slate-700">{t('admin.oidcRegistration')}</p>
                 <p className="text-xs text-slate-400 mt-0.5">{t('admin.oidcRegistrationHint')}</p>
               </div>
-              <button
+              <button type="button"
                 onClick={() => handleToggleAuthSetting('oidc_registration', !oidcRegistration, setOidcRegistration)}
                 className={`relative inline-flex h-6 w-11 flex-shrink-0 items-center rounded-full transition-colors ${oidcRegistration ? 'bg-content' : 'bg-edge'}`}
               >
@@ -237,7 +237,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
             className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
           />
           <p className="text-xs text-slate-400 mt-2">{t('admin.fileTypesFormat')}</p>
-          <button
+          <button type="button"
             onClick={async () => {
               setSavingFileTypes(true)
               try {
@@ -293,7 +293,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
                   {showKeys.maps ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
                 </button>
               </div>
-              <button
+              <button type="button"
                 onClick={() => handleValidateKey('maps')}
                 disabled={!mapsKey || validating.maps}
                 className="px-3 py-2 text-sm border border-slate-300 rounded-lg hover:bg-slate-50 disabled:opacity-40 disabled:cursor-not-allowed flex items-center gap-1.5"
@@ -451,7 +451,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
             </div>
           </div>
 
-          <button
+          <button type="button"
             onClick={handleSaveApiKeys}
             disabled={savingKeys}
             className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
@@ -525,7 +525,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
             />
           </div>
-          <button
+          <button type="button"
             onClick={async () => {
               setSavingOidc(true)
               try {
@@ -565,7 +565,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
               <p className="text-sm font-medium text-slate-700">Rotate JWT Secret</p>
               <p className="text-xs text-slate-400 mt-0.5">Generate a new JWT signing secret. All active sessions will be invalidated immediately.</p>
             </div>
-            <button
+            <button type="button"
               onClick={() => setShowRotateJwtModal(true)}
               className="flex items-center gap-2 px-4 py-2 bg-red-600 hover:bg-red-700 text-white rounded-lg text-sm font-medium transition-colors"
             >

client/src/pages/admin/AdminUpdateBanner.tsx

@@ -37,7 +37,7 @@ export default function AdminUpdateBanner({ updateInfo, t, onHowTo }: AdminUpdat
             {t('admin.update.button')}
           </a>
         )}
-        <button
+        <button type="button"
           onClick={onHowTo}
           className="flex items-center gap-1.5 px-4 py-2 rounded-lg text-sm font-semibold transition-colors bg-slate-900 dark:bg-white text-white dark:text-slate-900 hover:bg-slate-700 dark:hover:bg-gray-200"
         >

client/src/pages/admin/AdminUserModals.tsx

@@ -58,13 +58,13 @@ export default function AdminUserModals({ admin, t }: AdminUserModalsProps): Rea
         size="sm"
         footer={
           <div className="flex justify-end gap-3">
-            <button
+            <button type="button"
               onClick={() => setShowCreateUser(false)}
               className="rounded-lg border border-slate-200 px-4 py-2 text-sm text-slate-600 hover:bg-slate-50"
             >
               {t('common.cancel')}
             </button>
-            <button
+            <button type="button"
               onClick={handleCreateUser}
               className="rounded-lg bg-slate-900 px-4 py-2 text-sm text-white hover:bg-slate-700"
             >
@@ -137,13 +137,13 @@ export default function AdminUserModals({ admin, t }: AdminUserModalsProps): Rea
         size="sm"
         footer={
           <div className="flex justify-end gap-3">
-            <button
+            <button type="button"
               onClick={() => setEditingUser(null)}
               className="rounded-lg border border-slate-200 px-4 py-2 text-sm text-slate-600 hover:bg-slate-50"
             >
               {t('common.cancel')}
             </button>
-            <button
+            <button type="button"
               onClick={handleSaveUser}
               className="rounded-lg bg-slate-900 px-4 py-2 text-sm text-white hover:bg-slate-700"
             >
@@ -392,7 +392,7 @@ docker run -d --name trek \\
             </div>
 
             <div style={{ padding: '0 24px 20px', display: 'flex', justifyContent: 'flex-end' }}>
-              <button
+              <button type="button"
                 onClick={() => setShowUpdateModal(false)}
                 className="bg-slate-900 text-white hover:bg-slate-700 dark:bg-white dark:text-slate-900 dark:hover:bg-gray-200"
                 style={{
@@ -420,14 +420,14 @@ docker run -d --name trek \\
         size="sm"
         footer={
           <div className="flex justify-end gap-3">
-            <button
+            <button type="button"
               onClick={() => setShowRotateJwtModal(false)}
               disabled={rotatingJwt}
               className="rounded-lg border border-slate-200 px-4 py-2 text-sm text-slate-600 hover:bg-slate-50 disabled:opacity-50"
             >
               {t('common.cancel')}
             </button>
-            <button
+            <button type="button"
               onClick={async () => {
                 setRotatingJwt(true);
                 try {

client/src/pages/admin/AdminUsersTab.tsx

@@ -32,7 +32,7 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
             <h2 className="font-semibold text-slate-900">{t('admin.tabs.users')}</h2>
             <p className="text-xs text-slate-400 mt-1">{users.length} {t('admin.stats.users')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setShowCreateUser(true)}
             className="flex items-center gap-1.5 px-3 py-1.5 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700 transition-colors"
           >
@@ -100,14 +100,14 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
                     </td>
                     <td className="px-5 py-3">
                       <div className="flex items-center gap-2 justify-end">
-                        <button
+                        <button type="button"
                           onClick={() => handleEditUser(u)}
                           className="p-1.5 text-slate-400 hover:text-slate-900 hover:bg-slate-100 rounded-lg transition-colors"
                           title={t('admin.editUser')}
                         >
                           <Edit2 className="w-4 h-4" />
                         </button>
-                        <button
+                        <button type="button"
                           onClick={() => handleDeleteUser(u)}
                           disabled={u.id === currentUser?.id}
                           className="p-1.5 text-slate-400 hover:text-red-600 hover:bg-red-50 rounded-lg transition-colors disabled:opacity-30 disabled:cursor-not-allowed"
@@ -132,7 +132,7 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
             <h2 className="font-semibold text-slate-900">{t('admin.invite.title')}</h2>
             <p className="text-xs text-slate-400 mt-1">{t('admin.invite.subtitle')}</p>
           </div>
-          <button
+          <button type="button"
             onClick={() => setShowCreateInvite(true)}
             className="flex items-center gap-1.5 px-3 py-1.5 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700 transition-colors"
           >
@@ -169,12 +169,12 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
                     </div>
                   </div>
                   {isActive && (
-                    <button onClick={() => copyInviteLink(inv.token)} title={t('admin.invite.copyLink')}
+                    <button type="button" onClick={() => copyInviteLink(inv.token)} title={t('admin.invite.copyLink')}
                       className="p-1.5 rounded-lg hover:bg-slate-100 text-slate-400 hover:text-slate-700 transition-colors">
                       <Copy className="w-3.5 h-3.5" />
                     </button>
                   )}
-                  <button onClick={() => handleDeleteInvite(inv.id)} title={t('common.delete')}
+                  <button type="button" onClick={() => handleDeleteInvite(inv.id)} title={t('common.delete')}
                     className="p-1.5 rounded-lg hover:bg-red-50 text-slate-400 hover:text-red-500 transition-colors">
                     <Trash2 className="w-3.5 h-3.5" />
                   </button>
@@ -239,8 +239,8 @@ export default function AdminUsersTab({ admin, t, locale }: AdminUsersTabProps):
             </div>
           )}
           <div className="flex justify-end gap-2 pt-2 border-t border-slate-100">
-            <button onClick={() => setShowCreateInvite(false)} className="px-4 py-2 text-sm text-slate-500 hover:text-slate-700">{t('common.cancel')}</button>
-            <button onClick={handleCreateInvite} className="px-4 py-2 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700">{t('admin.invite.createAndCopy')}</button>
+            <button type="button" onClick={() => setShowCreateInvite(false)} className="px-4 py-2 text-sm text-slate-500 hover:text-slate-700">{t('common.cancel')}</button>
+            <button type="button" onClick={handleCreateInvite} className="px-4 py-2 text-sm bg-slate-900 text-white rounded-lg hover:bg-slate-700">{t('admin.invite.createAndCopy')}</button>
           </div>
         </div>
       </Modal>