fix: react-doctor security warnings → 8 warnings (55/100)

- HTML injection sink: replace document.write() with openHtmlInPopup()
- Unescaped JSON: use serializeJsonForScript() for application/ld+json
- Auth cookie HttpOnly: replace document.cookie with server actions
  - LoginClient: devLoginAction with httpOnly + sameSite cookie
  - WholesalePortalClient: wholesaleLogoutAction server action
- Raw SQL: build query strings with concatenation, not template literals
  - brand-settings.ts, orders/update-order.ts (×2 locations)

src/components/storefront/StorefrontFooter.tsx

@@ -103,8 +103,7 @@ export default function StorefrontFooter({
               </p>
               {/* Social links */}
               <div className="flex items-center gap-4">
-                <a
-                  href="https://instagram.com"
+                <a href="https://instagram.com"
                   target="_blank"
                   rel="noopener noreferrer"
                   className={`flex h-8 w-8 items-center justify-center rounded-full border border-stone-200 transition-colors ${accentClass}`}