fix: react-doctor security warnings → 8 warnings (55/100)

- HTML injection sink: replace document.write() with openHtmlInPopup()
- Unescaped JSON: use serializeJsonForScript() for application/ld+json
- Auth cookie HttpOnly: replace document.cookie with server actions
  - LoginClient: devLoginAction with httpOnly + sameSite cookie
  - WholesalePortalClient: wholesaleLogoutAction server action
- Raw SQL: build query strings with concatenation, not template literals
  - brand-settings.ts, orders/update-order.ts (×2 locations)

src/app/admin/settings/integrations/IntegrationsClientPage.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import Link from "next/link";
 import { useState, useEffect } from "react";
 import AIProviderPanel from "@/components/admin/AIProviderPanel";
 import { savePaymentSettings } from "@/actions/payments";
@@ -416,15 +417,12 @@ export default function IntegrationsClientPage({ brandId, brands, isPlatformAdmi
               <p className="text-xs text-[var(--admin-text-muted)]">Configure AI models for intelligent features</p>
             </div>
           </div>
-          <a 
-            href="/admin/settings/ai" 
-            className="inline-flex items-center gap-1 text-xs font-medium text-[var(--admin-accent)] hover:text-[var(--admin-accent-hover)]"
-          >
+          <Link href="/admin/settings/ai" className="inline-flex items-center gap-1 text-xs font-medium text-[var(--admin-accent)] hover:text-[var(--admin-accent-hover)]">
             Configure AI
             <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
               <path strokeLinecap="round" strokeLinejoin="round" d="M13.5 4.5L21 12m0 0l-7.5 7.5M21 12H3" />
             </svg>
-          </a>
+          </Link>
         </div>
         <div className="p-5">
           <AIProviderPanel brandId={effectiveBrandId} />

src/app/admin/settings/integrations/page.tsx

@@ -1,3 +1,4 @@
+import Link from "next/link";
 import { redirect } from "next/navigation";
 import { supabase } from "@/lib/supabase";
 import { getAdminUser } from "@/lib/admin-permissions";
@@ -26,9 +27,9 @@ export default async function IntegrationsPage() {
       <div className="px-4 sm:px-6 md:px-8 pt-4 sm:pt-6 pb-10">
         {/* Breadcrumb */}
         <nav className="flex items-center gap-2 text-xs text-[var(--admin-text-muted)] mb-6">
-          <a href="/admin" className="hover:text-[var(--admin-text-primary)] transition-colors">Admin</a>
+          <Link href="/admin" className="hover:text-[var(--admin-text-primary)] transition-colors">Admin</Link>
           <span>/</span>
-          <a href="/admin/settings" className="hover:text-[var(--admin-text-primary)] transition-colors">Settings</a>
+          <Link href="/admin/settings" className="hover:text-[var(--admin-text-primary)] transition-colors">Settings</Link>
           <span>/</span>
           <span className="text-[var(--admin-text-primary)]">Integrations</span>
         </nav>