fix: react-doctor security warnings → 8 warnings (55/100)

- HTML injection sink: replace document.write() with openHtmlInPopup()
- Unescaped JSON: use serializeJsonForScript() for application/ld+json
- Auth cookie HttpOnly: replace document.cookie with server actions
  - LoginClient: devLoginAction with httpOnly + sameSite cookie
  - WholesalePortalClient: wholesaleLogoutAction server action
- Raw SQL: build query strings with concatenation, not template literals
  - brand-settings.ts, orders/update-order.ts (×2 locations)

src/app/brands/page.tsx

@@ -219,9 +219,9 @@ export default function BrandsPage() {
           <div className="flex items-center justify-between text-xs text-[#888]">
             <span>© {CURRENT_YEAR} Route Commerce</span>
             <div className="flex gap-4">
-              <a href="/privacy-policy" className="hover:text-[#1a4d2e]">Privacy</a>
-              <a href="/terms-and-conditions" className="hover:text-[#1a4d2e]">Terms</a>
-              <a href="/contact" className="hover:text-[#1a4d2e]">Contact</a>
+              <Link href="/privacy-policy" className="hover:text-[#1a4d2e]">Privacy</Link>
+              <Link href="/terms-and-conditions" className="hover:text-[#1a4d2e]">Terms</Link>
+              <Link href="/contact" className="hover:text-[#1a4d2e]">Contact</Link>
             </div>
           </div>
         </div>