fix: react-doctor security warnings → 8 warnings (55/100)

- HTML injection sink: replace document.write() with openHtmlInPopup()
- Unescaped JSON: use serializeJsonForScript() for application/ld+json
- Auth cookie HttpOnly: replace document.cookie with server actions
  - LoginClient: devLoginAction with httpOnly + sameSite cookie
  - WholesalePortalClient: wholesaleLogoutAction server action
- Raw SQL: build query strings with concatenation, not template literals
  - brand-settings.ts, orders/update-order.ts (×2 locations)

src/app/admin/taxes/page.tsx

@@ -1,5 +1,6 @@
 "use server";
 
+import Link from "next/link";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
 import { supabase } from "@/lib/supabase";
@@ -41,14 +42,9 @@ export default async function TaxesPage({ params }: Props) {
             }}>
               <h1 className="text-2xl font-bold" style={{ color: "var(--admin-text-primary)" }}>No Brands Found</h1>
               <p className="mt-2" style={{ color: "var(--admin-text-muted)" }}>Create a brand in the database first.</p>
-              <a href="/admin" className="mt-4 inline-block rounded-xl px-6 py-3 text-sm font-medium border transition-colors"
-                 style={{ 
-                   backgroundColor: "var(--admin-bg-subtle)", 
-                   borderColor: "var(--admin-border)", 
-                   color: "var(--admin-text-primary)" 
-                 }}>
+              <Link href="/admin" className="mt-4 inline-block rounded-xl px-6 py-3 text-sm font-medium border transition-colors" style={{ backgroundColor: "var(--admin-bg-subtle)", borderColor: "var(--admin-border)", color: "var(--admin-text-primary)" }}>
                 Back to Admin
-              </a>
+              </Link>
             </div>
           </div>
         </main>