Fix PR #124 remaining issues: XSS, state management, DB regression

- kill_all() now resets gsm_spy_scanner_running and related state so
  the scanner thread stops after killall
- scanner_thread sets flag to False instead of None on exit
- Restore alert_rules, alert_events, recording_sessions tables and
  wifi_clients column removed by PR in database.py
- Escape all server-sourced values in analysis modals with escapeHtml()
- Reset gsm_towers_found/gsm_devices_tracked on stop to prevent
  counter drift across sessions
- Replace raw terminate/kill with safe_terminate() in scanner_thread

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

utils/database.py

@@ -102,6 +102,52 @@ def init_db() -> None:
             )
         ''')
 
+        # Alert rules
+        conn.execute('''
+            CREATE TABLE IF NOT EXISTS alert_rules (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                name TEXT NOT NULL,
+                mode TEXT,
+                event_type TEXT,
+                match TEXT,
+                severity TEXT DEFAULT 'medium',
+                enabled BOOLEAN DEFAULT 1,
+                notify TEXT,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        ''')
+
+        # Alert events
+        conn.execute('''
+            CREATE TABLE IF NOT EXISTS alert_events (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                rule_id INTEGER,
+                mode TEXT,
+                event_type TEXT,
+                severity TEXT DEFAULT 'medium',
+                title TEXT,
+                message TEXT,
+                payload TEXT,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                FOREIGN KEY (rule_id) REFERENCES alert_rules(id) ON DELETE SET NULL
+            )
+        ''')
+
+        # Session recordings
+        conn.execute('''
+            CREATE TABLE IF NOT EXISTS recording_sessions (
+                id TEXT PRIMARY KEY,
+                mode TEXT NOT NULL,
+                label TEXT,
+                started_at TIMESTAMP NOT NULL,
+                stopped_at TIMESTAMP,
+                file_path TEXT NOT NULL,
+                event_count INTEGER DEFAULT 0,
+                size_bytes INTEGER DEFAULT 0,
+                metadata TEXT
+            )
+        ''')
+
         # Users table for authentication
         conn.execute('''
             CREATE TABLE IF NOT EXISTS users (
@@ -139,6 +185,7 @@ def init_db() -> None:
                 description TEXT,
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                 wifi_networks TEXT,
+                wifi_clients TEXT,
                 bt_devices TEXT,
                 rf_frequencies TEXT,
                 gps_coords TEXT,
@@ -146,6 +193,14 @@ def init_db() -> None:
             )
         ''')
 
+        # Ensure new columns exist for older databases
+        try:
+            columns = {row['name'] for row in conn.execute("PRAGMA table_info(tscm_baselines)")}
+            if 'wifi_clients' not in columns:
+                conn.execute('ALTER TABLE tscm_baselines ADD COLUMN wifi_clients TEXT')
+        except Exception as e:
+            logger.debug(f"Schema update skipped for tscm_baselines: {e}")
+
         # TSCM Sweeps - Individual sweep sessions
         conn.execute('''
             CREATE TABLE IF NOT EXISTS tscm_sweeps (
@@ -818,6 +873,7 @@ def create_tscm_baseline(
     location: str | None = None,
     description: str | None = None,
     wifi_networks: list | None = None,
+    wifi_clients: list | None = None,
     bt_devices: list | None = None,
     rf_frequencies: list | None = None,
     gps_coords: dict | None = None
@@ -831,13 +887,14 @@ def create_tscm_baseline(
     with get_db() as conn:
         cursor = conn.execute('''
             INSERT INTO tscm_baselines
-            (name, location, description, wifi_networks, bt_devices, rf_frequencies, gps_coords)
-            VALUES (?, ?, ?, ?, ?, ?, ?)
+            (name, location, description, wifi_networks, wifi_clients, bt_devices, rf_frequencies, gps_coords)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
         ''', (
             name,
             location,
             description,
             json.dumps(wifi_networks) if wifi_networks else None,
+            json.dumps(wifi_clients) if wifi_clients else None,
             json.dumps(bt_devices) if bt_devices else None,
             json.dumps(rf_frequencies) if rf_frequencies else None,
             json.dumps(gps_coords) if gps_coords else None