fix: correções Baixo da auditoria (escaping, dvh, transições, assets)

Fecha os itens 3.2.2, 3.3.1, 4.6, 5.2, 5.6, 5.7 e 7.4 do relatório de
auditoria de 2026-09-24: escapa saídas de site_img_url()/canonical,
valida identificadores de coluna em db_info_save(), troca 100vh por
100dvh, remove a última cor solta, encurta a transição para ~150ms,
acrescenta decoding=async/fetchpriority=high nas imagens da home, e
documenta as versões vendorizadas em ASSETS.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

site/includes/crossfit_badge.php

@@ -4,7 +4,7 @@
     <div class="row">
       <div class="col-lg-6">
         <div class="section-title">
-          <h2><a href="https://journal.crossfit.com" target="_blank" title="CrossFit Journal: The Performance-Based Lifestyle Resource"> <img  loading="lazy" src="https://de45qwmlmgefw.cloudfront.net/badges/black-300x150.png" width="300px" height="150" alt="CrossFit Journal: The Performance-Based Lifestyle Resource" /></a></h2>
+          <h2><a href="https://journal.crossfit.com" target="_blank" title="CrossFit Journal: The Performance-Based Lifestyle Resource"> <img  loading="lazy" decoding="async" src="https://de45qwmlmgefw.cloudfront.net/badges/black-300x150.png" width="300px" height="150" alt="CrossFit Journal: The Performance-Based Lifestyle Resource" /></a></h2>
         </div>
       </div>
       <div class="col-lg-6">

site/includes/header_video.php

@@ -7,7 +7,7 @@
   <div class="container h-100">
     <div class="d-flex h-100 text-center align-items-center">
       <div class="w-100 text-white">
-        <h1 class="display-3"><img src="<?= base_url('site/assets/img/logos/logo_crossfit_white.svg')?>" alt="CrossFit 3070 — box de CrossFit em Mira" style="opacity: .85; max-width: 320px;"></h1>
+        <h1 class="display-3"><img src="<?= base_url('site/assets/img/logos/logo_crossfit_white.svg')?>" alt="CrossFit 3070 — box de CrossFit em Mira" style="opacity: .85; max-width: 320px;" decoding="async"></h1>
         <p class="lead mb-0"></p>
       </div>
     </div>

site/includes/horario.php

@@ -69,7 +69,7 @@ foreach ($rows as $d) { $grid[$d['dia_semana']][$d['hora_inicio']][] = $d; }
                 <div class="schedule_cell<?= $value === $default_day ? '' : ' sched-hide' ?>" data-day="<?= htmlspecialchars($value) ?>" data-section="<?= ((int) substr($time, 0, 2) < 12) ? 'manha' : 'tarde' ?>" style="grid-column:<?= $col ?>;grid-row:<?= $row_of[$time] ?>;">
                   <?php foreach ($grid[$value][$time] as $d): ?>
                   <div class="schedule_box" style="background-color:<?= htmlspecialchars((string) $d['cor']) ?>">
-                    <img src="<?= site_img_url($d['icon'], 'uploads/modalidades/icons') ?>" alt="<?= htmlspecialchars((string) $d['nome']) ?>">
+                    <img src="<?= htmlspecialchars(site_img_url($d['icon'], 'uploads/modalidades/icons')) ?>" alt="<?= htmlspecialchars((string) $d['nome']) ?>" decoding="async">
                     <a><b><?= htmlspecialchars((string) $d['nome']) ?></b></a>
                     <div class="schedule_info">
                       <?= htmlspecialchars((string) $d['hora_inicio']) ?>

site/includes/include.php

@@ -41,7 +41,7 @@ $canonical = $GLOBALS['_canonical_override'] ?? match ($page) {
 <meta name="author" content="FitMe 3070">
 <meta name="theme-color" content="#C2D500">
 <title><?= htmlspecialchars($page_title) ?></title>
-<link rel="canonical" href="<?= $canonical ?>">
+<link rel="canonical" href="<?= htmlspecialchars($canonical) ?>">
 <?php if (seo_noindex()): /* staging copies (e.g. fitme.andmore.pt) must not compete with the real domain */ ?>
 <meta name="robots" content="noindex, nofollow">
 <?php endif; ?>
@@ -51,7 +51,7 @@ $canonical = $GLOBALS['_canonical_override'] ?? match ($page) {
 <link rel="dns-prefetch" href="https://forms.zohopublic.eu">
 <?php if (($current_uri_2 ?? '') === ''): ?>
 <!-- Homepage hero is the LCP image — start fetching it before the CSS/JS -->
-<link rel="preload" as="image" href="<?= base_url(($gym_meta['hero_image'] ?? '') !== '' ? $gym_meta['hero_image'] : 'site/assets/img/home.jpg') ?>">
+<link rel="preload" as="image" fetchpriority="high" href="<?= htmlspecialchars(base_url(($gym_meta['hero_image'] ?? '') !== '' ? $gym_meta['hero_image'] : 'site/assets/img/home.jpg')) ?>">
 <?php endif; ?>
 
 <!-- Fonts -->
@@ -72,7 +72,7 @@ $canonical = $GLOBALS['_canonical_override'] ?? match ($page) {
 <link rel="apple-touch-icon" sizes="180x180" href="<?= base_url('site/assets/img/logos/apple-touch-icon.png') ?>">
 
 <!-- Open Graph / link previews -->
-<meta property="og:url" content="<?= $canonical ?>">
+<meta property="og:url" content="<?= htmlspecialchars($canonical) ?>">
 <meta property="og:type" content="<?= htmlspecialchars($GLOBALS['_og_type_override'] ?? 'website') ?>">
 <meta property="og:site_name" content="FitMe 3070">
 <meta property="og:locale" content="pt_PT">

site/includes/navbar.php

@@ -10,7 +10,7 @@ else
 <header class="header-section lazy">
   <nav class="navbar navbar-expand-lg navbar-light" style="padding-left:1rem; padding-top: 0; padding-bottom: 0;padding-right: 0; ">
       <a class="navbar-brand" href="<?= htmlspecialchars(gym_url(current_gym())) ?>">
-      <img loading="eager" alt="Logo FitMe3070" src="<?= $logo ?>" style="width: 150px;">
+      <img loading="eager" decoding="async" alt="Logo FitMe3070" src="<?= $logo ?>" style="width: 150px;">
     </a>
     <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation"> <span class="navbar-toggler-icon"></span> </button>
     <div class="collapse navbar-collapse" id="navbarSupportedContent">