fix(ook): address upstream PR review — SDR tracking, validation, cleanup, XSS

Critical:
- Pass sdr_type_str to claim/release_sdr_device (was missing 3rd arg)
- Add ook_active_sdr_type module-level var for proper device registry tracking
- Add server-side range validation on all timing params via validate_positive_int

Major:
- Extract cleanup_ook() function for full teardown (stop_event, pipes, process,
  SDR release) — called from both stop_ook() and kill_all()
- Replace Popen monkey-patching with module-level _ook_stop_event/_ook_parser_thread
- Fix XSS: define local _esc() fallback in ook.js, never use raw innerHTML
- Remove dead inversion code path in utils/ook.py (bytes.fromhex on same
  string that already failed decode — could never produce a result)

Minor:
- Status event key 'status' → 'text' for consistency with other modules
- Parser thread logging: debug → warning for missing code field and errors
- Parser thread emits status:stopped on exit (normal EOF or crash)
- Add cache-busting ?v={{ version }}&r=ook1 to ook.js script include
- Fix gain/ppm comparison: != '0' (string) → != 0 (number)

Tests: 22 → 33 (added start success, stop with process, SSE stream,
timing range validation, stopped-on-exit event)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

static/js/modes/ook.js

@@ -12,6 +12,13 @@ var OokMode = (function () {
     var DEFAULT_FREQ_PRESETS = ['433.920', '315.000', '868.000', '915.000'];
     var MAX_FRAMES = 5000;
 
+    // Local XSS-safe escape — never fall back to raw innerHTML
+    var _esc = typeof escapeHtml === 'function' ? escapeHtml : function (s) {
+        var d = document.createElement('div');
+        d.textContent = s;
+        return d.innerHTML;
+    };
+
     var state = {
         running: false,
         initialized: false,
@@ -147,7 +154,7 @@ var OokMode = (function () {
         if (msg.type === 'ook_frame') {
             handleFrame(msg);
         } else if (msg.type === 'status') {
-            if (msg.status === 'stopped') {
+            if (msg.text === 'stopped') {
                 state.running = false;
                 updateUI(false);
                 disconnectSSE();
@@ -245,7 +252,7 @@ var OokMode = (function () {
             '</span>' +
             '<br>' +
             '<span style="padding-left:8em; color:' + (hasPrintable ? '#aaffcc' : '#555') + '; font-family:var(--font-mono); font-size:10px">' +
-            'ascii: ' + (typeof escapeHtml === 'function' ? escapeHtml(interp.ascii) : interp.ascii) +
+            'ascii: ' + _esc(interp.ascii) +
             '</span>';
 
         div.style.cssText = 'font-size:11px; padding: 4px 0; border-bottom: 1px solid #1a1a1a; line-height:1.6;';