1.0.9: Security/code-quality fix: replaced dynamic HTML string insertion (innerHTML) throughout the stats panel and modals with safe DOM construction (createElement/textContent). No visible functionality changes.