fix: correções Baixo da auditoria (escaping, dvh, transições, assets)

Fecha os itens 3.2.2, 3.3.1, 4.6, 5.2, 5.6, 5.7 e 7.4 do relatório de
auditoria de 2026-09-24: escapa saídas de site_img_url()/canonical,
valida identificadores de coluna em db_info_save(), troca 100vh por
100dvh, remove a última cor solta, encurta a transição para ~150ms,
acrescenta decoding=async/fetchpriority=high nas imagens da home, e
documenta as versões vendorizadas em ASSETS.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

site/includes/include.php

@@ -41,7 +41,7 @@ $canonical = $GLOBALS['_canonical_override'] ?? match ($page) {
 <meta name="author" content="FitMe 3070">
 <meta name="theme-color" content="#C2D500">
 <title><?= htmlspecialchars($page_title) ?></title>
-<link rel="canonical" href="<?= $canonical ?>">
+<link rel="canonical" href="<?= htmlspecialchars($canonical) ?>">
 <?php if (seo_noindex()): /* staging copies (e.g. fitme.andmore.pt) must not compete with the real domain */ ?>
 <meta name="robots" content="noindex, nofollow">
 <?php endif; ?>
@@ -51,7 +51,7 @@ $canonical = $GLOBALS['_canonical_override'] ?? match ($page) {
 <link rel="dns-prefetch" href="https://forms.zohopublic.eu">
 <?php if (($current_uri_2 ?? '') === ''): ?>
 <!-- Homepage hero is the LCP image — start fetching it before the CSS/JS -->
-<link rel="preload" as="image" href="<?= base_url(($gym_meta['hero_image'] ?? '') !== '' ? $gym_meta['hero_image'] : 'site/assets/img/home.jpg') ?>">
+<link rel="preload" as="image" fetchpriority="high" href="<?= htmlspecialchars(base_url(($gym_meta['hero_image'] ?? '') !== '' ? $gym_meta['hero_image'] : 'site/assets/img/home.jpg')) ?>">
 <?php endif; ?>
 
 <!-- Fonts -->
@@ -72,7 +72,7 @@ $canonical = $GLOBALS['_canonical_override'] ?? match ($page) {
 <link rel="apple-touch-icon" sizes="180x180" href="<?= base_url('site/assets/img/logos/apple-touch-icon.png') ?>">
 
 <!-- Open Graph / link previews -->
-<meta property="og:url" content="<?= $canonical ?>">
+<meta property="og:url" content="<?= htmlspecialchars($canonical) ?>">
 <meta property="og:type" content="<?= htmlspecialchars($GLOBALS['_og_type_override'] ?? 'website') ?>">
 <meta property="og:site_name" content="FitMe 3070">
 <meta property="og:locale" content="pt_PT">