Fix dashboard rendering and report submission reliability

[pralav-25]

Asset names and citizen descriptions were interpolated into HTML, allowing stored markup to create elements in the dashboard, map popups, and citizen selector. Quoted asset names also broke the inline chart handler. API values now use DOM text APIs, and chart and repair controls use event listeners. Resolved reports are removed from the incident feed while preserving its latest-eight ordering.

The citizen form also had two competing submit handlers: a timer could announce success and clear the form before the API responded, and a successful upload permanently hid the modal. One async handler now waits for the API, prevents duplicate pending submissions, preserves input after failures, displays errors as text, and resets the form only after success. The modal can then reopen for another report.

Added reproducible Chromium tests, local test instructions, and GitHub Actions for browser and Python validation.

Validation:

• All 10 Chromium tests pass. The original rendering suite reproduced 5 failures, and the added submission suite reproduced 4 more failures before their fixes.
• All 10 existing Python validation and scoring tests pass.
• A separate smoke check with real Leaflet, Chart.js, and Bootstrap verified the popup and chart for a quoted asset name without JavaScript errors.
• Whitespace checks pass with the HTML files' existing CRLF line endings preserved.

Browser regression tests mock the API and map dependencies; they do not require a running database or external CDN.