fix: address bug review findings

- Debounce MutationObserver (200ms) and scope to #modelGrid when available
- Sanitize data.updated via parseInt before innerHTML to prevent XSS
- Guard pagination against page_size=0 (division by zero) and negative values
- Reject non-POST requests on /api/lm-extra/fetch-stats (state-mutating)
- Early return in upsert_batch for empty rows list

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

stats_db.py

@@ -74,6 +74,8 @@ class StatsDB:
 
     def upsert_batch(self, rows: list[tuple[str, dict]]) -> None:
         """Insert or update stats for multiple models."""
+        if not rows:
+            return
         conn = self._ensure_conn()
         now = time.time()
         conn.executemany(