ui: harden workspace and secrets rendering

TASKS.md

@@ -2,20 +2,19 @@
 
 ## Current
 
-### `feat/frontend-xss-hardening`
+### `feat/frontend-shell-unification`
 
 Status: in_progress
 
 DoD:
-- API-derived data is not inserted into `innerHTML` without escaping
-- shared DOM-safe helpers are introduced for frontend rendering paths that still need markup
-- known unsafe rendering paths from `__REVIEW_FRONT.md` are removed or hardened
-- the current UI behavior remains intact after the hardening pass
-- targeted frontend smoke checks cover the touched pages
+- duplicated shell identity logic is removed from `auth.js` and `nav.js`
+- one shared source of truth renders avatar, name, role, and menu state
+- pages keep the current shell behavior after the consolidation
+- no page depends on divergent copies of `crank_user` handling
 
 ## Next
 
-- `feat/frontend-shell-unification`
+- `feat/frontend-wizard-modularization`
 
 ## Backlog