Frontend polish: CDN-failure resilience, link safety, a11y, UX fixes

[LukasWallrich]

Part of a repo audit. Frontend-only changes (no build step; verified with node --check and element-ID cross-checks):

• CDN-failure resilience: every new Chart / Plotly render entry point is now guarded — if a chart library fails to load (ad-blocker, offline), the affected chart shows an inline "Chart unavailable" message instead of an uncaught error that previously aborted table/FAQ/data-stamp initialization for the whole page.
• FAQ link scheme allow-list: markdown links from the remote FAQ file only become anchors for http:/https:/mailto:; other schemes (e.g. javascript:) render as plain text.
• rel="noopener noreferrer" added to all 24 target="_blank" anchors in index.html (JS-generated links already had it).
• Citation modal keyboard access: Escape closes it; focus moves to the close button on open and returns to the trigger on close.
• Repo-casing normalized to forrtproject/fred-data (GitHub's canonical full_name) — two URLs used FReD-data while a third used lowercase.
• Citation Impact loading state: a "Loading…" placeholder shows immediately on init instead of a blank panel until three fetches resolve.
• Unbiased shuffle: Random Examples now uses Fisher–Yates instead of sort(() => Math.random() - 0.5).
• Dead schema fields removed: effect_o/effect_r/n_o/n_r/description never exist in flora.csv and could never render.

Deliberately does not touch the Mean Citedness sections of app.js — those are fixed in #4.

🤖 Generated with Claude Code

[LukasWallrich]

Codex review (gpt, read-only): REQUEST_CHANGES — two high findings, both addressed in 518cbbf:

1. High — scheme allow-list bypassable with a leading C0 control character (browsers strip them, exposing javascript:), and protocol-relative/relative URLs slipped through a scheme-only check. ✅ Fixed: the whole trimmed URL must now start with http:, https:, or mailto:; everything else renders as plain text. Unit-tested against the bypass cases.
2. High — the CDN guard could permanently replace healthy charts: app.js intentionally runs before the chart libraries, and a fast cached data fetch can resolve while Chart.js is still downloading, so a guard could fire during normal load with no re-render afterward (and a later theme re-render would then throw on the removed canvas). ✅ Fixed: before the window load event, guards defer one retry to load instead of declaring failure; after load, a missing library is treated as a genuine CDN failure.

Codex verified the rest cleanly: chartLibMissing global visibility to citation-impact.js, modal Escape/focus logic (no leaks or double registration), loading placeholders replaced on both success and failure paths, all 24 target="_blank" anchors covered, dead-field removal behavior-neutral, and lowercase repo paths valid (GitHub paths are case-insensitive).

[LukasWallrich]

Codex re-verified the fix commit: URL validation sound, retry closures and load timing correct. One residual nit — the five trend-chart guards could each queue their own renderAllTrends retry before window load — fixed by deduping retries by function identity. Codex confirmed the rest of the fixes clean.