Improve accessibility, SEO, security, and routing robustness

[radumarias]

Summary

A focused code review of index.html surfaced accessibility, SEO, security, and routing issues. This PR fixes the actionable findings. All changes are confined to index.html and were verified with a headless Chromium smoke test (no JS/page errors; project cards, routing, headings, and the ⌘K terminal all work).

Accessibility

• Converted visual headings to real <h1>/<h2>/<h3> elements (retaining classes, so styling is unchanged)
• Added a <main id="content"> landmark and a "Skip to content" link
• Made previously mouse-only controls keyboard-operable: the ⌘K terminal trigger is now a <button>, the "reset filter" control is a <button>, and each project card now uses a stretched detail-link anchor with the "Open ↗" action as a real sibling link (removing invalid nested-interactive markup)
• Labeled the terminal input (aria-label) and made the terminal output a live region (role="log" aria-live="polite")
• Added aria-pressed to theme buttons and aria-current to active nav links and filter chips
• Added focus management on route changes (focus moves to the new view's heading; suppressed on initial load)

SEO

• Added meta description, Open Graph and Twitter Card tags, canonical URL, theme-color, an inline SVG favicon (data URI), and JSON-LD Organization structured data

Security

• Added rel="noopener noreferrer" to all target="_blank" links (static and JS-generated)
• Hardened esc() to also escape single quotes
• Added a safeUrl() scheme allow-list (https:/mailto: only) applied to data-derived hrefs and window.open calls

Correctness

• Normalized unknown routes: an unknown #p/<id> or invalid #f/<key> now cleans the URL and falls back to home / all instead of leaving a stale hash with a desynced view
• The terminal filter <tag> command now reports an error for unknown tags instead of silently emptying the gallery
• Interpolated the previously hardcoded project/experiment counts in the terminal banner so they can't drift from the data

Not addressed (flagged for follow-up)

• The rencfs issue numbers differ between the project helpIssues and the EXPERIMENTS list (the pairs appear shuffled). At least one set links to the wrong GitHub issue, but the correct numbers can't be determined without checking the live repo, so they were left unchanged.
• Client-side-only (JS-rendered) content and hash-based routing limit crawler visibility; SSR/prerendering would be a larger structural change.

Verification

Reviewed the full diff and ran a headless Chromium (Playwright) smoke test: page has a single <main> and an <h1>, the ⌘K control is a <button>, the terminal input is labeled, clicking a card routes to #p/<id>, and bogus #p/nope / #f/bogus routes are cleaned. No page or console JS errors (only sandbox-blocked Google Fonts network requests).

Review and fixes performed via Claude Code from a Slack thread: https://syncoxiders.slack.com/archives/C0BLHUEA74K/p1785356245573589?thread_ts=1785352424.084699&cid=C0BLHUEA74K

---

Generated by Claude Code