fix: address PR #145 review issues

- Escape ac.icao, callsign, typeCode with escapeHtml() in aircraft card (XSS)
- Add linking comments between duplicated IATA_TO_ICAO mappings
- VDL2 sidebar: single-click selects aircraft, double-click opens modal
- Remove stale ICAOs from acarsAircraftIcaos in cleanupOldAircraft()
- Add null guard to drawPolarPlot() in weather-satellite.js
- Move deferred imports (translate_message, get_flight_correlator) to module level
- Check all frequency checkboxes by default on initial load
- Remove extra blank lines and uncertain MC/MCO airline code entry
- Add TODO comments linking duplicated renderAcarsCard implementations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

utils/airline_codes.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import re
 
 # IATA (2-letter) → ICAO (3-letter) mapping for common airlines
+# NOTE: Duplicated in templates/adsb_dashboard.html (JS IATA_TO_ICAO) — keep both in sync
 IATA_TO_ICAO: dict[str, str] = {
     # North America — Major
     "AA": "AAL",  # American Airlines
@@ -112,8 +113,6 @@ IATA_TO_ICAO: dict[str, str] = {
     "AV": "AVA",  # Avianca
     "CM": "CMP",  # Copa Airlines
     "AR": "ARG",  # Aerolíneas Argentinas
-    # ACARS-specific addressing codes
-    "MC": "MCO",  # Possible: some ACARS systems use MC
 }
 
 # Build reverse mapping (ICAO → IATA)