fix: address bug review findings

- Debounce MutationObserver (200ms) and scope to #modelGrid when available
- Sanitize data.updated via parseInt before innerHTML to prevent XSS
- Guard pagination against page_size=0 (division by zero) and negative values
- Reject non-POST requests on /api/lm-extra/fetch-stats (state-mutating)
- Early return in upsert_batch for empty rows list

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

proxy.py

@@ -284,8 +284,8 @@ async def _proxy_list_with_stats_sort(
     """Fetch all items from remote, sort by stats locally, paginate."""
     from urllib.parse import urlencode
 
-    page = int(request.query.get("page", "1"))
-    page_size = int(request.query.get("page_size", "20"))
+    page = max(1, int(request.query.get("page", "1")))
+    page_size = max(1, int(request.query.get("page_size", "20")))
     sort_key, _, order = sort_by.partition(":")
     order = order or "desc"
 
@@ -342,6 +342,8 @@ async def _proxy_list_with_stats_sort(
 
 async def _handle_fetch_stats(request: web.Request) -> web.Response:
     """Bulk fetch CivitAI stats for all models."""
+    if request.method != "POST":
+        return web.json_response({"error": "POST required"}, status=405)
     try:
         from .stats_service import StatsFetchService
     except ImportError: