Backlog/v12 alerts fixes

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Blocking issues

One or more high/critical issues can break things and must be fixed before merging. Details below.

✅ architecture (gemini-3-flash-lite) — clean

Summary: Frontend UI layout updates (removing max-width constraints) and addition of alert deep-linking functionality.

No findings.

🛑 bugs (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Introduced a potential XSS vulnerability by using an tag with a dynamic href without sanitization, and removed layout constraints across multiple pages.

• high frontend/src/features/incidents/components/incident-alerts-tab.tsx:18 — Potential XSS vulnerability: The a.alertName property is used directly in an href attribute. If alertName contains javascript: URIs, it could lead to script execution. Ensure alertName is sanitized or validated before use.

⚠️ security (gemini-3-flash-lite) — non-blocking warnings

Summary: Added deep-linking for alerts using URL parameters without sufficient sanitization of the alert name.

• medium frontend/src/features/alerts/pages/AlertsPage.tsx:77 — The alert name from the URL parameter is decoded and used directly in a filter object. While React handles DOM rendering safely, ensure that the backend API consuming these filters properly validates the 'name' field to prevent potential injection or unexpected query behavior.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.