fix: react-doctor security warnings → 8 warnings (55/100)

- HTML injection sink: replace document.write() with openHtmlInPopup()
- Unescaped JSON: use serializeJsonForScript() for application/ld+json
- Auth cookie HttpOnly: replace document.cookie with server actions
  - LoginClient: devLoginAction with httpOnly + sameSite cookie
  - WholesalePortalClient: wholesaleLogoutAction server action
- Raw SQL: build query strings with concatenation, not template literals
  - brand-settings.ts, orders/update-order.ts (×2 locations)

src/app/admin/settings/integrations/page.tsx

@@ -1,3 +1,4 @@
+import Link from "next/link";
 import { redirect } from "next/navigation";
 import { supabase } from "@/lib/supabase";
 import { getAdminUser } from "@/lib/admin-permissions";
@@ -26,9 +27,9 @@ export default async function IntegrationsPage() {
       <div className="px-4 sm:px-6 md:px-8 pt-4 sm:pt-6 pb-10">
         {/* Breadcrumb */}
         <nav className="flex items-center gap-2 text-xs text-[var(--admin-text-muted)] mb-6">
-          <a href="/admin" className="hover:text-[var(--admin-text-primary)] transition-colors">Admin</a>
+          <Link href="/admin" className="hover:text-[var(--admin-text-primary)] transition-colors">Admin</Link>
           <span>/</span>
-          <a href="/admin/settings" className="hover:text-[var(--admin-text-primary)] transition-colors">Settings</a>
+          <Link href="/admin/settings" className="hover:text-[var(--admin-text-primary)] transition-colors">Settings</Link>
           <span>/</span>
           <span className="text-[var(--admin-text-primary)]">Integrations</span>
         </nav>