fix: react-doctor security warnings → 8 warnings (55/100)

- HTML injection sink: replace document.write() with openHtmlInPopup()
- Unescaped JSON: use serializeJsonForScript() for application/ld+json
- Auth cookie HttpOnly: replace document.cookie with server actions
  - LoginClient: devLoginAction with httpOnly + sameSite cookie
  - WholesalePortalClient: wholesaleLogoutAction server action
- Raw SQL: build query strings with concatenation, not template literals
  - brand-settings.ts, orders/update-order.ts (×2 locations)

src/app/admin/communications/welcome-sequence/page.tsx

@@ -1,3 +1,4 @@
+import Link from "next/link";
 import type { Metadata } from "next";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getBrandSettings } from "@/actions/brand-settings";
@@ -23,9 +24,9 @@ export default async function WelcomeSequencePage() {
         {/* Header */}
         <div>
           <nav className="flex items-center gap-2 text-xs text-stone-500 mb-4">
-            <a href="/admin" className="hover:text-stone-600 transition-colors">Admin</a>
+            <Link href="/admin" className="hover:text-stone-600 transition-colors">Admin</Link>
             <span>/</span>
-            <a href="/admin/communications" className="hover:text-stone-600 transition-colors">Communications</a>
+            <Link href="/admin/communications" className="hover:text-stone-600 transition-colors">Communications</Link>
             <span>/</span>
             <span className="text-stone-600">Welcome Sequence</span>
           </nav>